This advisory covers security fixes for Red Hat Service Interconnect version 1.4 for RHEL 9 and RHEL 8. It addresses three main vulnerabilities: CVE-2024-12797, where OpenSSL's RFC7250 handshakes with unauthenticated servers do not abort as expected; CVE-2024-56171, a use-after-free vulnerability in libxml2; and CVE-2025-24928, a stack-based buffer overflow in the xmlSnprintfElements function of libxml2. The update is classified as having a Moderate security impact by Red Hat Product Security. No CVSS base score is provided in the advisory. The vendor recommends applying this update only after all previously released errata relevant to the system have been applied. The advisory references multiple CVEs and provides links for further details and update instructions.

The vulnerabilities fixed include a failure in OpenSSL to abort RFC7250 handshakes with unauthenticated servers, which could lead to insecure connections; a use-after-free flaw in libxml2 that may cause memory corruption; and a stack-based buffer overflow in libxml2 that could lead to memory corruption or crashes. These issues collectively pose a risk of denial of service or potential code execution, though the advisory rates the overall impact as Moderate. There are no known exploits in the wild at this time.

Red Hat has released an update for Red Hat Service Interconnect 1.4 for RHEL 9 and RHEL 8 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been installed. Detailed update instructions are available at Red Hat's official documentation. No additional mitigation steps are indicated or required beyond applying the official update.