Skip to main content
EPSS 0.5%top 62%

Red Hat Security Advisory: python-kdcproxy security update

0
High
Published: 11/17/2025 (11/17/2025, 06:19:12 UTC)
Source: GCVE Database
Vendor/Project: Red Hat Product Security
Product: Red Hat

Description

Two security vulnerabilities were identified in the python-kdcproxy component of Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The first is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability via realm-controlled DNS SRV records (CVE-2025-59088). The second is a remote Denial of Service (DoS) vulnerability caused by unbounded TCP upstream buffering (CVE-2025-59089). Red Hat has released an important security update addressing these issues for multiple architectures and lifecycle variants of RHEL 9.2.

Affected software

redhat/python-kdcproxy
pkg:rpm/redhat/python-kdcproxy
Affected versions
=9.2

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 06/28/2026, 22:20:27 UTC

Technical Analysis

Red Hat Product Security issued an advisory (RHSA-2025:21448) for python-kdcproxy in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The advisory addresses two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote DoS vulnerability due to unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy versions prior to the fixed release included in the update. The update is rated as Important by Red Hat and is available for multiple architectures including x86_64, ppc64le, aarch64, and s390x. The advisory provides packages to remediate these issues.

Potential Impact

The SSRF vulnerability (CVE-2025-59088) allows an unauthenticated attacker to induce the python-kdcproxy service to make unintended network requests, potentially leading to information disclosure or interaction with internal services. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities impact the availability and security of systems running the affected python-kdcproxy versions on Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.

Mitigation Recommendations

Red Hat has released an official security update fixing these vulnerabilities in python-kdcproxy for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Users should apply the update as described in the Red Hat advisory RHSA-2025:21448 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patch. Patch status is confirmed as fixed in the updated packages provided by Red Hat.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Csaf Category
csaf_security_advisory
Csaf Version
2.0
Publisher
Red Hat Product Security
Advisory Id
RHSA-2025:21448
Cve Count
2
Additional Cves
["CVE-2025-59089"]

Threat ID: 6a419cab27e9c79719ab8fd0

Added to database: 06/28/2026, 22:14:03 UTC

Last enriched: 06/28/2026, 22:20:27 UTC

Last updated: 09/10/2026, 19:36:51 UTC

Views: 22

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses