RHSA-2026:88330MediumCVSS 6.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 22, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-85518 →

📋 Description

CVE-2026-85518 — openscap: openscap: Arbitrary file write via path traversal in Source DataStream decomposition

🎯 Affected products29

  • Red Hat Hardened Images
  • openscap-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-1:1.4.5-2.1.hum1@src as a component of Red Hat Hardened Images
  • openscap-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openscap-containers-1:1.4.5-2.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • openscap-containers-1:1.4.5-2.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • openscap-containers-1:1.4.5-2.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • openscap-devel-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-devel-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-devel-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openscap-engine-sce-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-engine-sce-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-engine-sce-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openscap-engine-sce-devel-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-engine-sce-devel-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-engine-sce-devel-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openscap-perl-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-perl-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-perl-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openscap-python3-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-python3-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-python3-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openscap-scanner-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-scanner-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-scanner-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openscap-utils-1:1.4.5-2.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openscap-utils-1:1.4.5-2.1.hum1@s390x as a component of Red Hat Hardened Images
  • openscap-utils-1:1.4.5-2.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Avoid extracting or decomposing untrusted SCAP Source DataStream (SDS) files. When processing externally supplied datastreams is necessary, perform the operation inside an isolated directory using a dedicated unprivileged user account or container sandbox with strictly bounded write privileges. Caveat: Operating under an unprivileged user confines rogue file creation to that user's access scope, but does not prevent file corruption within directories accessible to that account.

🔗 References (5)