This security advisory addresses multiple vulnerabilities in RHEL-8 based Middleware Containers container images, primarily related to Python 3.11 tarfile extraction flaws (including CVE-2024-12718) and libxml2 vulnerabilities. The issues include bypassing extraction filters to modify file metadata or create symlinks outside the extraction directory, arbitrary writes via tarfile realpath overflow, heap use-after-free leading to denial of service, type confusion causing denial of service, integer overflow leading to stack buffer overflow, and Linux-PAM directory traversal. These vulnerabilities affect container images used in Red Hat OpenShift Container Platform 4.10, 4.11, and 4.12 for RHEL 8. The advisory provides updated container images with backported patches to correct these security issues and encourages users to upgrade and rebuild dependent images. The vendor advisory confirms the availability of official fixes and provides detailed remediation instructions and references.

The vulnerabilities addressed could allow attackers to bypass extraction filters, modify file metadata outside intended directories, create arbitrary symlinks, perform arbitrary writes, cause denial of service via heap use-after-free and type confusion, trigger stack buffer overflows, and exploit directory traversal in Linux-PAM. These issues could compromise container image integrity and security, potentially leading to unauthorized file modifications or denial of service conditions within affected container environments. The severity is rated as high by the vendor.

Red Hat has released updated RHEL-8 based Middleware Containers container images containing backported patches that fix these vulnerabilities. Users should upgrade to these updated images available from the Red Hat Container Registry and rebuild all container images that depend on them. Dockerfiles and scripts should be updated to reference the new or latest images. Follow the installation instructions provided in the Red Hat Container Catalog and the vendor advisories (RHSA-2025:10026 and RHSA-2025:11386) for detailed guidance. No additional mitigation steps are indicated beyond applying these official updates.