RHSA-2026:56347HighCVSS 8.5

Red Hat Security Advisory: Migration Toolkit for Applications

Published
August 18, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (11)

CVE-2025-58183 →CVE-2025-61729 →CVE-2026-8643 →CVE-2026-25681 →CVE-2026-27136 →CVE-2026-44432 →CVE-2026-59886 →CVE-2025-47907 →CVE-2025-53547 →CVE-2026-44431 →CVE-2026-59885 →

📋 Description

CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-53547 — helm.sh/helm/v3: Helm Chart Code Execution CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-8643 — python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-44431 — urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44432 — urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-59885 — pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

🎯 Affected products28

  • Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:217d17628517a32622bdcc0876a1001e4401e0b7dd4000424c117590cb032680_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:745dd840ff971dc2079fddd2b48554bd06fbae2c653db71581ba1424586e18b5_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-cli-rhel9@sha256:578edd839979fafbc8648a1cbe508263285b39e765e6a8d8be51e47d2f02f338_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-cli-rhel9@sha256:98335eb713618111e76134d014e544f2aa3cfc33e70dc45136f9ae0c6d3cf92a_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:23547d00b217e51c82f3a13bc24e9b24b8be8846b32b7c54221f7a5d06af14f0_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:711d2f89b670111a19e8aea50abfe5916792829860dea145494e1a874e376ed5_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:064603da13efaa261f392666f3460868f4020155fdbf793da69840fe3ab24ee2_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:c5081a7efaeab495ef639cb5a3cc4e4b496d922785975a9bb20b39a77a7f7a60_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:1708f82dc5ee43752afb8a43f859c821619d2f351935b0124a080859e78563d7_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:c559e696d4a93e407bb99558abccedc6c20d40478c8cee2395672bc6b9868c09_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-hub-rhel9@sha256:9ec7176c85ff087b94299dac428592bb319f6b87179f412eb3fa9ac4f1dfbd08_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-hub-rhel9@sha256:ec57ea8103b8ca3d6231c8d647ecc1b9275f5b9aba92aa773bfebbf07e0746ba_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:21eb077c0e6023f3a01473352b18d1440b2b8575b3721013c0470dc90aae5d39_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:85c0cfc68dd650dbeb229edc15d209d10346ddd49e068ad8a2eb5970557c9387_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:27eb7837e87060c65c7bc0eddfc32a295764ca2e0c4e8db2ebdee9ae5d91d830_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:9b324fbe469630b52c2a5276b690a69ad4919c4aa2129af5510820bae148b98a_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-operator-bundle@sha256:46e80cea9ed559ba86ffc80d164d1d2ec80f316e315ffecc2c3e2cc00bd3b0ed_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:881fe8805b1a6b255dc5a9dfd1dff9757c432d1d94ecfa4db38505a332f29376_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:d8bfece0657f837ae32197d56f268ad9d82c10df76717e06cdc3bfe1afd89f6e_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:a1545456691e4f3cf20e1ff084df38918bca04e20c6be889e6c2b993252a29c4_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:aa2c27ffd47d25e428e89d7f8ae54040508d898b5ade5889132e8c0dd4e93d6b_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-rhel9-operator@sha256:923e0fbe8f2c884cade697c2bc7ca1c083d905be1d16aed57676d6bf680e37dd_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-rhel9-operator@sha256:d7e2a29f4829c56906dfd89f58de7f7369cf7a4504cc5e6a641ffdd979762ec5_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-solution-server-rhel9@sha256:673a421ba816f250d4a73168ce016416c4040f6fef01b777e2ff682e12b4f44c_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-solution-server-rhel9@sha256:67c988666ee09c4397405c02a6d67d210dc54e1f50c943fba4f5b471a231ac17_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-ui-rhel9@sha256:0c2bed0250adfaf45251a115074fd65f574eb555cdc5b8063bcf7504347e4678_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2
  • registry.redhat.io/mta/mta-ui-rhel9@sha256:23f68bb5ba586f82c05e8a49b0adf2164acf8eca7dd34dedb226ca4f8c23019e_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.

🔗 References (16)