Red Hat Security Advisory: python-kdcproxy security update
Two security vulnerabilities were identified in the python-kdcproxy component of Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The first is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability via realm-controlled DNS SRV records (CVE-2025-59088). The second is a remote Denial of Service (DoS) vulnerability caused by unbounded TCP upstream buffering (CVE-2025-59089). Red Hat has released an important security update addressing these issues for multiple architectures and lifecycle variants of RHEL 9.2.
AI Analysis
Technical Summary
Red Hat Product Security issued an advisory (RHSA-2025:21448) for python-kdcproxy in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The advisory addresses two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote DoS vulnerability due to unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy versions prior to the fixed release included in the update. The update is rated as Important by Red Hat and is available for multiple architectures including x86_64, ppc64le, aarch64, and s390x. The advisory provides packages to remediate these issues.
Potential Impact
The SSRF vulnerability (CVE-2025-59088) allows an unauthenticated attacker to induce the python-kdcproxy service to make unintended network requests, potentially leading to information disclosure or interaction with internal services. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities impact the availability and security of systems running the affected python-kdcproxy versions on Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Mitigation Recommendations
Red Hat has released an official security update fixing these vulnerabilities in python-kdcproxy for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Users should apply the update as described in the Red Hat advisory RHSA-2025:21448 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patch. Patch status is confirmed as fixed in the updated packages provided by Red Hat.
Red Hat Security Advisory: python-kdcproxy security update
Description
Two security vulnerabilities were identified in the python-kdcproxy component of Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The first is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability via realm-controlled DNS SRV records (CVE-2025-59088). The second is a remote Denial of Service (DoS) vulnerability caused by unbounded TCP upstream buffering (CVE-2025-59089). Red Hat has released an important security update addressing these issues for multiple architectures and lifecycle variants of RHEL 9.2.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Product Security issued an advisory (RHSA-2025:21448) for python-kdcproxy in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The advisory addresses two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote DoS vulnerability due to unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy versions prior to the fixed release included in the update. The update is rated as Important by Red Hat and is available for multiple architectures including x86_64, ppc64le, aarch64, and s390x. The advisory provides packages to remediate these issues.
Potential Impact
The SSRF vulnerability (CVE-2025-59088) allows an unauthenticated attacker to induce the python-kdcproxy service to make unintended network requests, potentially leading to information disclosure or interaction with internal services. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities impact the availability and security of systems running the affected python-kdcproxy versions on Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Mitigation Recommendations
Red Hat has released an official security update fixing these vulnerabilities in python-kdcproxy for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Users should apply the update as described in the Red Hat advisory RHSA-2025:21448 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patch. Patch status is confirmed as fixed in the updated packages provided by Red Hat.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:21448
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-59089"]
Threat ID: 6a419cab27e9c79719ab8fd0
Added to database: 06/28/2026, 22:14:03 UTC
Last enriched: 06/28/2026, 22:20:27 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.