RHSA-2026:63138HighCVSS 8.1

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

Published
September 3, 2026
Last Modified
September 11, 2026

🔗 CVE IDs covered (17)

CVE-2026-11824 →CVE-2026-15588 →CVE-2026-46600 →CVE-2026-58015 →CVE-2026-9547 →CVE-2026-58012 →CVE-2026-58014 →CVE-2026-1965 →CVE-2026-8286 →CVE-2026-56852 →CVE-2026-54371 →CVE-2026-58013 →CVE-2026-58055 →CVE-2026-58010 →CVE-2026-58011 →CVE-2026-3783 →CVE-2026-11822 →

📋 Description

CVE-2026-1965 — curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-3783 — curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect CVE-2026-8286 — curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-9547 — curl: curl: Man-in-the-middle attack via SSH host key bypass CVE-2026-11822 — sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11824 — sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 CVE-2026-15588 — GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing CVE-2026-54371 — attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-58010 — glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() CVE-2026-58011 — glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime CVE-2026-58012 — glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() CVE-2026-58013 — glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" CVE-2026-58014 — glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVE-2026-58015 — glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive CVE-2026-58055 — nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

🎯 Affected products9

  • Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:03d6509e8064ac056a47ca9ab43df0639236f09806cd551f13a0e808f469c0ee_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:71c8d77b5e9ad20eea144b431446f29795a7788a31401ebead4290455cce2b5a_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:75e764fa7c8af058297efcf6c0b1599cbdb244e15fbe76530429d43b1b168dd2_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:f3d617c66947b62a6ff65e68ca48d2ea80d3eb343bcbd245c150fe355d91b534_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4d12a56f417d74bba1bd339f05f4b4cfa2a48fd3e0957c51353a6de3f21f4fa8_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:97c32b60fc77d27a05fe3ef130d9b69554c793d9df70e0b524d88a5d61254482_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:afbe54974b9b3bc95455f16baad7e44e629eeb5a4ead75d74b30ac43359937fe_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.19
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:cdb8e7edf0a0438cd8578bedea2e0a4bef66276ac51e20912da5d8ad6d82e266_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.19

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field. Workaround: To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\u, \l, \U, \L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue. Workaround: To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue. Workaround: To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue. Workaround: To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue. Workaround: Configure your WAF or load balancer to drop incoming HTTP/1.1 requests that contain both Upgrade and Content-Length headers. This blocks the malformed traffic at the edge before it can reach the vulnerable proxy without impacting legitimate users.

🔗 References (21)