Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

This security update for apr-util addresses several vulnerabilities: CVE-2025-49506 is a timing side-channel attack in apr_password_validate() that can leak password hash content by measuring comparison timing differences, primarily affecting platforms without crypt() implementations. CVE-2026-32327 is an XML stack recursion crash. CVE-2026-34191 is an SQL injection vulnerability in apr_dbd_oracle. CVE-2026-34501 and CVE-2026-34502 are heap buffer overflows in Redis and APR memcached clients respectively. Red Hat released apr-util version 1.6.5-1 to fix these issues. The timing attack vulnerability is considered low impact due to high attack complexity and practical network noise, and standard deployments typically rely on system crypt() bypassing the vulnerable code path.

The timing attack vulnerability (CVE-2025-49506) could theoretically disclose password hash content, impacting confidentiality, but practical exploitation is highly complex and unlikely over networks due to timing noise. The other vulnerabilities include potential denial of service (XML stack recursion crash) and remote code execution or data compromise risks from SQL injection and heap buffer overflows. Overall, these vulnerabilities pose critical security risks if unpatched.

Red Hat has released updated apr-util packages (version 1.6.5-1) that fix these vulnerabilities. Users should apply these official updates promptly. No alternative mitigations are currently recommended or available. The timing attack vulnerability is of low practical impact and no specific mitigation beyond patching is advised.