Threats Tagged 'cve-2026-14957'

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.37. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:63099 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ Security Fix(es): * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.37. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:63099 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ Security Fix(es): * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.

Multiple denial of service vulnerabilities and a crash issue have been identified in libreswan, an IPsec and IKE implementation for Linux. These include DoS via RSA-SHA1 authentication payloads in IKEv1 and IKEv2, malformed fragmentation in IKEv2, and an assertion failure triggered by badly formatted X.509 certificates causing daemon crashes. The vulnerabilities affect Red Hat Enterprise Linux 9.6 Extended Update Support and related distributions. A security update addressing these issues is available from Red Hat.

Multiple denial of service vulnerabilities and a crash issue have been identified in libreswan, an IPsec and IKE implementation for Linux. These include DoS via RSA-SHA1 authentication payloads in IKEv1 and IKEv2, DoS via malformed fragmentation in IKEv2, and an assertion failure caused by a badly formatted X.509 certificate that crashes the daemon. Red Hat has released an important security update for libreswan in Red Hat Enterprise Linux 10 to address these issues.

Multiple denial of service vulnerabilities have been identified in libreswan, an implementation of IPsec and IKE for Linux, affecting Red Hat Enterprise Linux 9. These include issues with RSA-SHA1 authentication payloads in IKEv1 and IKEv2, malformed fragmentation in IKEv2, and a badly formatted X.509 certificate causing assertion failures that crash the daemon process. Red Hat has issued a security update to address these vulnerabilities.

Multiple denial of service vulnerabilities and a crash issue have been identified in libreswan, an IPsec and IKE implementation for Linux. These include denial of service via RSA-SHA1 authentication payloads in both IKEv1 and IKEv2, malformed fragmentation in IKEv2, and an assertion failure caused by badly formatted X.509 certificates. These issues affect Red Hat Enterprise Linux 8 versions prior to 8.10.6. A security update addressing these vulnerabilities is available from Red Hat.

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.