Threat database

Red Hat OpenShift Container Platform 4.20.2 includes a security update addressing a race condition vulnerability in the database/sql package related to Postgres scanning (CVE-2025-47907). This update fixes a concurrency issue that could affect the stability or correctness of database operations. Users of OpenShift Container Platform 4.20 are advised to upgrade to this release to apply the fix.

CVE-2025-47273 is a path traversal vulnerability in the Python setuptools library used in Red Hat Enterprise Linux AI 1.5 (NVIDIA). It allows an attacker with limited code execution privileges in a Python environment to write files outside the intended temporary directory by manipulating package download URLs. This can lead to unauthorized overwrites of important system files, potentially causing persistent code execution or system misconfiguration. The vulnerability does not expose confidential data or enable cross-boundary access and does not inherently cause denial of service. No fix is currently available from Red Hat.

Red Hat Advanced Cluster Management for Kubernetes 2.14.1 includes a security update addressing multiple issues such as pod crashes, race conditions causing metric loss, UI refresh problems, excessive logging, and policy compliance errors. The update provides new features, enhancements, bug fixes, and updated container images to improve stability and security.

Multiple security issues have been addressed in the go1.25-1.25.2-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities affecting the SUSE product. No specific details about the nature of the vulnerabilities or affected versions are provided.

Multiple security issues have been fixed in the curl-8.16.0-1.1 package included in the GA media of openSUSE Tumbleweed. The advisory references CVE-2025-10148 among others, indicating these are known vulnerabilities addressed by this package update.

CVE-2024-35951 is a vulnerability in the panfrost driver related to an error path in the panfrost_mmu_map_fault_addr() function. The information provided does not include details on the impact or exploitation. The affected version is specifically version 2.0. No CVSS score or detailed impact description is available.