Red Hat Product Security has issued an important security advisory (RHSA-2025:21806) for python-kdcproxy in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The advisory addresses two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote Denial of Service vulnerability due to unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy version 1.0.0-7.el9_0.1 and related packages for multiple architectures. The advisory provides updated packages to fix these issues. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat. The advisory references Red Hat knowledge base article 11258 for update instructions and provides SHA-256 hashes for the fixed packages.

The SSRF vulnerability (CVE-2025-59088) allows an unauthenticated attacker to induce the python-kdcproxy component to make unintended network requests based on manipulated DNS SRV records, potentially leading to information disclosure or further attacks. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP upstream buffering. Both vulnerabilities impact the availability and security of systems running the affected python-kdcproxy versions in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.

Red Hat has released updated python-kdcproxy packages that address these vulnerabilities. Users should apply the security update RHSA-2025:21806 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations or workarounds are specified in the advisory. Systems running the affected versions should be updated to the fixed package versions provided by Red Hat.