RHSA-2026:82336HighCVSS 8.1

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.1

Published
October 13, 2026
Last Modified
October 16, 2026

🔗 CVE IDs covered (30)

CVE-2026-41989 →CVE-2026-48864 →CVE-2026-54371 →CVE-2026-58010 →CVE-2026-11979 →CVE-2026-29181 →CVE-2026-54370 →CVE-2026-58016 →CVE-2026-58055 →CVE-2025-6170 →CVE-2026-6238 →CVE-2026-8286 →CVE-2026-54369 →CVE-2026-1965 →CVE-2026-11822 →CVE-2026-11824 →CVE-2026-58013 →CVE-2026-6653 →CVE-2026-13757 →CVE-2026-3783 →CVE-2026-15588 →CVE-2026-58014 →CVE-2026-58015 →CVE-2026-14164 →CVE-2026-9547 →CVE-2026-58011 →CVE-2026-58012 →CVE-2026-5435 →CVE-2026-5928 →CVE-2026-16118 →

📋 Description

CVE-2025-6170 — libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2026-1965 — curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-3783 — curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect CVE-2026-5435 — glibc: glibc: Out-of-bounds write via TSIG record processing CVE-2026-5928 — glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-6238 — glibc: glibc: Application crash or uninitialized memory read via crafted DNS response CVE-2026-6653 — libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-8286 — curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-9547 — curl: curl: Man-in-the-middle attack via SSH host key bypass CVE-2026-11822 — sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11824 — sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 CVE-2026-11979 — libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-13757 — p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-14164 — libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() CVE-2026-15588 — GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering CVE-2026-16118 — xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c CVE-2026-29181 — github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers CVE-2026-41989 — Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext CVE-2026-48864 — libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data CVE-2026-54369 — acl: Symlink traversal privilege escalation via libacl functions CVE-2026-54370 — acl: TOCTOU Symlink Traversal via getfacl/setfacl CVE-2026-54371 — attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-58010 — glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() CVE-2026-58011 — glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime CVE-2026-58012 — glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() CVE-2026-58013 — glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" CVE-2026-58014 — glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVE-2026-58015 — glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive CVE-2026-58016 — glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" CVE-2026-58055 — nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

🎯 Affected products5

  • Cert Manager support for Red Hat OpenShift release 1.17
  • registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:1fb64ccdd260c52245fb50377f4ef2e92bfa1ce8c55ddaddbac7fe6b2c71709f_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.17
  • registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:28d5bea427d7c8fc6ba621bfc0cc62491ffee723ef4dd2f678383b9ae4cdac19_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.17
  • registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:74ca6440398a2a9fbcd3c2e25773ce4f1bcaf08f39e178f12fbf19ed59dd085e_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.17
  • registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:78431228c2902c8b51c50d5f487d1789f35ac994e3089e6448234f8b13577233_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.17

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations. Workaround: The affected functions are deprecated, application-debugging-only interfaces that are not part of the DNS resolver code path. Applications that call ns_printrrf(), ns_printrr(), or fp_nquery() can mitigate this issue by porting away from these interfaces, as recommended upstream, since they are not required for DNS resolution. For applications that cannot be changed, update to the glibc packages containing the fix that were released for the affected Red Hat products. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication. If p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention. Red Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw. Workaround: No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available. Workaround: Do not install a MIME magic file or content from untrusted sources. Workaround: Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory. Workaround: To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field. Workaround: To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\u, \l, \U, \L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue. Workaround: To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue. Workaround: To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue. Workaround: To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue. Workaround: To mitigate this vulnerability, implement input validation to sanitize untrusted D-Bus introspection XML, specifically rejecting malformed structures such as <node> elements improperly nested within <method>, <signal>, <property> or <arg> elements before calling g_dbus_node_info_new_for_xml(). Alternatively, restricting the application to only process XML input from trusted, authenticated sources will completely neutralize this issue. Workaround: Configure your WAF or load balancer to drop incoming HTTP/1.1 requests that contain both Upgrade and Content-Length headers. This blocks the malformed traffic at the edge before it can reach the vulnerable proxy without impacting legitimate users.

🔗 References (34)