Threat database

Red Hat OpenShift Container Platform 4.13.60 includes multiple security fixes addressing vulnerabilities in components such as libxslt, sudo, git, libxml2, and jq. These vulnerabilities include heap use-after-free, local privilege escalation, arbitrary code execution, arbitrary file writes, integer overflow leading to stack buffer overflow, and out-of-bounds reads. Users of OpenShift Container Platform 4.13 are advised to upgrade to the updated container images when available to mitigate these issues.

This entry refers to multiple security issues addressed in the govulncheck-vulndb-0.0.20250917T170349-1.1 package on the GA media of openSUSE Tumbleweed. The package update includes fixes for various vulnerabilities identified by multiple CVE identifiers. No specific details about the nature of these vulnerabilities or their impact are provided.

Multiple security issues were addressed in the go1.25-1.25.1-1.1 package for openSUSE Tumbleweed. These fixes are included in the GA media release of this package version. No specific vulnerabilities or impacts are detailed in the provided information.

CVE-2024-11218 is a vulnerability in Podman buildah that allows container breakout by exploiting a race condition when using the --jobs=2 option during the build of a malicious containerfile. The flaw relates to improper access control (CWE-269).

CVE-2024-9675 is a vulnerability in Buildah version 3.0 that allows arbitrary directory mounts. The description and details are minimal, with no CVSS score or detailed impact information provided.

CVE-2024-9341 concerns a directory mounting issue related to FIPS crypto-policy in the containers/common Go library used by Podman, buildah, and cri-o. The vulnerability involves improper handling of the crypto-policy directory, potentially leading to security risks. No CVSS score or detailed impact information is provided. No known exploits or patches are currently documented.

Multiple security issues have been addressed in the go1.24-1.24.6-1.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of the Go language package distributed by SUSE. No specific details about the nature of the vulnerabilities or their impact are provided.

A security update for Git addresses an arbitrary code execution vulnerability identified as CVE-2025-48384. Git is a distributed version control system that allows users to work with complete revision history locally. This vulnerability could allow an attacker to execute arbitrary code via Git. Red Hat has issued an important security advisory for this issue affecting Red Hat Enterprise Linux 8.6 variants. The advisory includes updated Git packages to remediate the vulnerability.

Red Hat has released version 3.5.1 of its OpenShift distributed tracing platform (Jaeger) which includes security improvements addressing multiple vulnerabilities. This update fixes CVE-2024-34397 among others, improving the security posture of the platform. No breaking changes, deprecations, or new features are introduced in this release.

A moderate severity vulnerability (CVE-2025-5024) in GNOME Remote Desktop allows uncontrolled resource consumption due to malformed RDP PDUs. This issue affects the gnome-remote-desktop component used in Red Hat Enterprise Linux 8.2 AUS. A security update addressing this vulnerability is available from Red Hat.