Red Hat Security Advisory: goose security update

This advisory covers four security vulnerabilities in the 'goose' component used in Red Hat Enterprise Linux 9. CVE-2026-72718 allows arbitrary command execution via malicious Git configuration in the 'goose review' command. CVE-2026-63127 involves token impersonation due to missing OAuth resource field validation in the RMCP module. CVE-2026-63128 is a denial of service vulnerability caused by unauthenticated session table leaks in RMCP. CVE-2026-93599 is a denial of service vulnerability in the rustls-webpki library triggered by a crafted Certificate Revocation List. Red Hat has released an update to goose version 1.45 to address these issues, included in Red Hat Enterprise Linux 9.8.z.

The vulnerabilities allow attackers to execute arbitrary commands, impersonate tokens, and cause denial of service conditions, potentially impacting system integrity and availability. The arbitrary command execution vulnerability could allow execution of malicious commands via crafted Git configurations. Token impersonation could lead to unauthorized access. Denial of service vulnerabilities could disrupt service availability. These issues affect Red Hat Enterprise Linux 9 across multiple hardware architectures.

Red Hat has provided an official fix by updating goose to version 1.45 in Red Hat Enterprise Linux 9.8.z. Users should ensure all previously released errata are applied and then update to this version following Red Hat's instructions at https://access.redhat.com/articles/11258. Applying this update remediates the described vulnerabilities.