Search: 18.8.3.2

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

FasterXML Jackson 1.x versions, including jackson-mapper-asl 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, contain a vulnerability that allows denial of service (DoS) attacks. This occurs when an attacker supplies deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-109413 is a high-severity vulnerability in the Symfony YAML component affecting versions prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The issue arises from uncontrolled recursion in the YAML parser's lexInlineStructure function, which does not properly limit nesting levels for inline collections. This can cause stack exhaustion and crash the process or cause a fatal error when parsing deeply nested YAML input. Any code parsing untrusted YAML is vulnerable, including endpoints using #[MapRequestPayload] without restricting the accepted format. The vulnerability is exploitable without authentication by sending a crafted YAML payload.

CVE-2026-108082 is a high-severity vulnerability in the Symfony PHP framework affecting multiple versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7. The issue arises from inefficient regular expression complexity in HeaderUtils::split(), which processes HTTP header values. This can cause exponential backtracking when parsing headers with runs of whitespace before separators, leading to high CPU usage and denial of service. The vulnerability is reachable without authentication via crafted HTTP requests. From 18 spaces onward, the regex engine hits backtrack limits, causing header directives to be silently dropped.

The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, and 5.0

The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, and 5.0

CVE-2026-98432 is a critical vulnerability in the linux-aws kernel versions 4.4.0-1002.2 through 4.4.0-1031.34 involving improper freeing of inet_opt and ireq_opt structures after an RCU grace period. This flaw can lead to severe impacts including complete confidentiality, integrity, and availability compromise of affected systems.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.18.57. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:79039 Security Fix(es): * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

Znuny versions through 7.3.6 have a SQL injection vulnerability in the ticket search functionality. The vulnerability arises because user input for the ContentSearch parameter is concatenated directly into SQL queries without proper validation or parameterization. This can allow attackers to inject arbitrary SQL commands, potentially leading to data theft, modification, or denial of service.

Znuny versions through 7.3.6 contain a critical vulnerability allowing attackers to bypass standard login procedures by manipulating the 'Remote-User' HTTP request header. This flaw enables impersonation of any user, including administrators, without requiring a password, granting full access to sensitive data and system controls.

A vulnerability in NGINX Plus and NGINX Open Source arises when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before the map output variable. This flaw can be exploited by unauthenticated attackers sending crafted HTTP requests, potentially causing a heap buffer overflow that leads to worker process restarts or, in some cases, remote code execution on systems with ASLR disabled or bypassed. The issue affects certain Ubuntu package versions of NGINX and has been addressed in updated releases.

GitPython versions from 3.1.62 before 3.2.0 have a symlink-following vulnerability in the Submodule.move() function. This flaw allows an untrusted repository to commit a symbolic link pointing outside the working tree, which can cause the application to relocate the submodule checkout externally, leading to corruption of the index and .gitmodules file.

GitPython versions before 3.2.0 have an argument injection vulnerability in the Head.checkout() method. This flaw allows remote attackers to read arbitrary files by supplying a specially crafted branch name that is interpreted as a git option. Specifically, an attacker can host a repository with a default branch named --pathspec-from-file=<path>, causing applications that clone and check out the active branch to leak file contents via GitCommandError messages.

GitPython versions from 3.1.30 before 3.2.0 contain a remote code execution vulnerability in the Remote.pull() method. The vulnerability arises because the unsafe-option guard only inspects keyword arguments and not positional refspec arguments, allowing attackers controlling the refspec to supply a malicious --upload-pack option. This can lead to execution of arbitrary OS commands as the calling process over local-path or SSH transports. The vulnerability has a high severity with a CVSS score of 8.1.