Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

The Red Hat security advisory RHSA-2026:57660 reports fixes for vulnerabilities in python3.11 packages included in Red Hat Hardened Images. Notably, CVE-2026-3479 is a path traversal vulnerability in the pkgutil.get_data() function caused by improper validation of resource arguments, enabling local attackers to read files outside intended directories. The update includes multiple python3.11 RPMs version 3.11.16-1.hum1 for aarch64 and x86_64 architectures. The advisory does not specify a fixed version explicitly but provides updated RPMs to address these issues. The vulnerabilities are rated medium severity. No mitigation other than applying the update is noted.

The primary impact is unauthorized local access to files outside of intended directories via the path traversal vulnerability in Python's pkgutil.get_data() function. This could lead to disclosure of sensitive information on affected systems. The vulnerabilities are rated medium severity, indicating a moderate risk level. There are no known exploits in the wild at this time.

Apply the updated Red Hat Hardened Images RPM packages for python3.11 version 3.11.16-1.hum1 as provided by Red Hat. The advisory does not list any alternative mitigations and notes that no current mitigation meets Red Hat's criteria for ease of use and applicability. Refer to https://images.redhat.com/ for update instructions and package downloads.