Threats Tagged 'cve-2025-62593'

Red Hat® AI Inference Server

Release of RHOAI 3.3 provides these changes:

Red Hat OpenShift AI 3.2 includes security updates addressing vulnerabilities identified as CVE-2025-62593 and CVE-2025-66418. The advisory highlights changes in the RHOAI 3.2 release but does not specify detailed fixes for these CVEs. The vulnerabilities relate to weaknesses categorized under CWE-94 (Improper Control of Generation of Code) and CWE-770 (Allocation of Resources Without Limits or Throttling). No known exploits are reported in the wild. Users are advised to upgrade to RHOAI 3.2 following Red Hat's official documentation for proper application of the update.

Release of RHOAI 2.25.1 provides these changes:

Red Hat® AI Inference Server

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.