This advisory covers a security update for Red Hat Update Infrastructure (RHUI) 5.1 container images, which are based on the latest RHUI RPM packages and ubi9 or ubi9-init base images. Among the addressed vulnerabilities is CVE-2025-11187, a flaw in OpenSSL versions 3.4, 3.5, and 3.6 where improper validation of PBMAC1 parameters in PKCS#12 MAC verification can cause a stack buffer overflow or NULL pointer dereference. This vulnerability can lead to denial of service or, in some cases, arbitrary code execution if an application processes a maliciously crafted PKCS#12 file. The advisory notes that exploitation requires processing untrusted PKCS#12 files, which is uncommon. The update includes multiple CVEs but does not explicitly list individual fixes. The updated container images should be deployed using the rhui-installer utility according to Red Hat's official documentation.

The impact includes potential denial of service and possible arbitrary code execution due to vulnerabilities in OpenSSL and other components included in RHUI container images. The CVE-2025-11187 vulnerability specifically can cause application crashes or code execution when processing malicious PKCS#12 files. However, exploitation requires local processing of crafted files, which are typically trusted and not commonly untrusted. No known exploits in the wild have been reported. The update mitigates these risks by providing updated container images with the latest security patches.

Deploy the updated Red Hat Update Infrastructure 5.1 container images provided by this release using the rhui-installer utility as described in the official Red Hat documentation. Avoid processing untrusted PKCS#12 files to mitigate the OpenSSL vulnerability CVE-2025-11187. Since this is a container image update, applying the updated images replaces vulnerable components. No additional immediate actions are specified in the advisory.