Red Hat Update Infrastructure 5 container images and associated Red Hat products, including Red Hat Discovery and Python 3.9 modules in RHEL 8, are affected by multiple security vulnerabilities identified by CVE-2024-5642 and 19 additional CVEs. These vulnerabilities include buffer over-read due to invalid OpenSSL API values, improper input validation, extraction filter bypasses, arbitrary file writes, and complexity issues in Python modules. The advisory references fixes in updated Python 3.9 packages and related components. The vendor advisory provides detailed information on the vulnerabilities and remediation steps via updated RPM packages and container images.

The vulnerabilities could lead to issues such as buffer over-read, improper validation of inputs, arbitrary file writes, and potential denial of service due to complexity attacks in Python components used within Red Hat Update Infrastructure and related products. The impact is rated medium by the vendor, indicating significant but not critical risk. There are no known exploits in the wild at this time.

Red Hat has released updated packages and container images addressing these vulnerabilities. Users should apply the official Red Hat updates as described in the vendor advisories (e.g., RHSA-2026:0414 and RHSA-2025:23530) to remediate the issues. The vendor advisory provides detailed instructions for applying these updates. Patch status is confirmed as available through these official updates.