Search: com.ar

Gatekeeper v3.20.1 Gatekeeper is a validating webhook with auditing capabilities that can enforce custom resource definition-based policies that are run with the Open Policy Agent (OPA). Gatekeeper is supported through a Red Hat Advanced Cluster Management for Kubernetes subscription. There are new parameters for the operator configuration, starting with version 3.20. View the following parameter descriptions: - `mutatingWebhookConfig`: Use the `mutatingWebhookConfig` parameter with the `webhook` parameter for overrides and configurations specific to the mutating webhook. The mutation-specific fields in `webhook` are deprecated. - `timeoutSeconds`: Use the `timeoutSeconds` parameter to customize webhook timeouts. - `rules`: Use the `rules` parameter to customize the requests that are handled by the webhook. Unlike other fields, the `rules` parameter values are specified separately for validating and mutating webhooks. Setting the `rules` parameter overrides anything that you set in the `operations` parameter. - `podAnnotations`: Specify the `podAnnotations` in `spec.audit` or `spec.webhook` to set deployment-specific annotations. Additional release notes: - Open Policy Agent Gatekeeper v3.20.0: https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.20.0 - Open Policy Agent Gatekeeper v3.20.1: https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.20.1

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.99. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:70647 Security Fix(es): None For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.99. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:70645 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes Security Fix(es): None For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.99. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:70647 Security Fix(es): None For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.58. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:70587 Security Fix(es): * github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env (CVE-2026-15809) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.58. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:70585 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.

This update for jline3 fixes the following issue: Update to upstream version 3.30.17: * Security Fixes + Native Stack Buffer Overflow in Public INPUT_RECORD.memmove JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6) + Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj) + Authenticated SSH DoS via Unbounded Window-Change Terminal Geometry (GHSA-m935-wqpj-pvp3) + TCP Socket File Descriptor Leak When Maximum Connections Reached (GHSA-c87g-867h-cqr6) * Bug Fixes + strip control characters from file names in posix builtins + bound !# history expansion to prevent exponential blowup + verify server host keys in the ssh client builtin + address remaining security vulnerabilities reported by AFINE/CERT.PL + backport security fixes from master + backport security fixes to 3.x (path traversal + DSR plain text) + strip control characters from ssh banner and prompts * Dependency updates + bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.2 + bump slf4j.version from 2.0.18 to 2.0.19 + bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 + bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 + bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.2 + bump actions/setup-java from 5 to 6.0.0 + bump org.graalvm.sdk:graal-sdk from 25.1.3 to 25.3.4.1 + bump com.mycila:license-maven-plugin from 5.0.0 to 5.1.2 + bump org.easymock:easymock from 5.6.0 to 5.7.0 + bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2 + bump org.apache.maven.wrapper:maven-wrapper from 3.3.2 to 3.3.4 + bump org.apache.maven:apache-maven from 4.0.0-rc-3 to 4.0.0-rc-6 + bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10 + bump com.palantir.javaformat:palantir-java-format from 2.96.0 to 2.97.0 + bump release-drafter/release-drafter from 7.6.0 to 7.7.0 + bump groovy.version from 4.0.32 to 4.0.33 + bump release-drafter/release-drafter from 7 to 7.6.0 + bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 - Update to upstream version 3.30.16 * bugfix release with security hardening, SSH agent forwarding fix, and terminal compatibility improvements. * Breaking Changes + SSH agent forwarding is no longer enabled by default; pass -A to explicitly request it + reject overlong hex components in OSC color responses + strip OSC and other escape sequences in ansiAppend + search multiple lib paths for versioned libutil.so + use Path.resolve instead of URI.resolve in cat and sort to prevent SSRF + check closed flag in PtyInputStream to prevent hang on empty input + confine ConfigurationPath lookups to the config directory + disable Read File command in nano restricted mode + drain buffered data before EOF in NonBlockingPumpInputStream + look up openpty in libc.so.6 for glibc 2.34+ + guard styleMatches and highlighter rules against ReDoS + backport telnet DoS mitigations (GHSA-47qp, GHSA-2r2c) + propagate EOF in PtyInputStream to avoid infinite loop + bump org.apache.ivy:ivy from 2.5.3 to 2.6.0 + bump actions/setup-node from 6 to 7 + bump com.palantir.javaformat:palantir-java-format from 2.94.0 to 2.96.0 + bump sshd.version from 2.18.0 to 2.19.0 + bump org.codehaus.gmavenplus:gmavenplus-plugin from 5.0.0 to 5.1.0 + bump org.graalvm.sdk:graal-sdk from 25.0.3 to 25.1.3 + bump com.diffplug.spotless:spotless-maven-plugin

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema_name results in path traversal. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 1.7.2 will fix this issue. You should upgrade the affected component.

CVE-2026-92173 is a critical vulnerability in Meta Horizon OS prior to version 74.0.0.878.1682. It involves improper restriction of communication channels, allowing an arbitrary application with NotificationListenerService to receive a privileged PendingIntent containing a CallerIdentity from com.oculus.vrshell. This enables impersonation of the com.oculus.vrshell package and other packages signed with the same key for authentication within the OS.

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.

The npm package com.epi.e2e_test version 1.2.2 contains malicious code that executes automatically during installation. A preinstall script runs an index.js file which collects host-specific identifiers such as the home directory, hostname, username, DNS servers, current working directory, and the package.json contents. This data is then sent via HTTPS to a hardcoded external server (meta.brs.cx) without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion or internal name attacks.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.49. There is no advisory for the RPM packages for this release. Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ Security Fix(es): * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's connection address was derived from the AmsNetId claimed in the response body rather than from the datagram's actual source address. One spoofed discovery response can therefore insert an inventory entry pointing at any host, including hosts outside the local network, and an application that connects to discovered devices will open its ADS session, including any configured route credentials, to that host. Additionally, discovery listeners in both implementations can be disabled by a single malformed datagram: - In PLC4Go ADS discovery, a short version block causes a panic that ends the listener for the rest of the discovery call, so legitimate devices answering afterwards are not reported. - In PLC4J, the ADS and EtherNet/IP discoverers stop on an unhandled exception from a malformed response. - The PLC4J Modbus discoverer can be made to spin indefinitely, consuming a CPU core, by a scanned host that sends a partial response. Exploitation requires the application to invoke the discovery API, which is opt-in, and for the connection redirect, to act on the discovered items. This issue affects Apache PLC4X: PLC4Go from 0.11.0 before 1.0.0; PLC4J ADS and Modbus drivers from 0.10.0 before 1.0.0; PLC4J EtherNet/IP driver from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases. Users are recommended to upgrade to version 1.0.0, which fixes the issue. Version 1.0.0 derives the connection address from the datagram's source address and logs a warning when the claimed AmsNetId disagrees with it.

Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application, causing a denial of service. The individual defects are: - Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1). - Transport read helpers allocate buffers of the size claimed on the wire without an upper bound. - ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic. - ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing. - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 . Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as additional, independent protocol messages. This issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases. Users are recommended to upgrade to version 1.0.0, which fixes the issue.