Threats Tagged 'cve-2026-15789'

Red Hat OpenShift AI 3.4.5 is a security advisory release that addresses multiple critical vulnerabilities identified by various CVEs including CVE-2025-61162. The advisory announces updated images for Red Hat OpenShift AI but does not provide specific details about the vulnerabilities or fixes in the release notes. Users are directed to official Red Hat documentation for upgrade instructions. No explicit patch details or affected versions are provided in the advisory content.

Multiple security vulnerabilities affecting the buildah package in Red Hat Enterprise Linux 9 have been identified and fixed. These include denial of service issues in several Go packages (net/http, encoding/asn1, net/url, crypto/tls) and a cross-site scripting vulnerability in Go html/template. The update improves the security of container image building and handling by addressing these issues.

Red Hat has released OpenShift Source To Image version 1.6.4 to address multiple security vulnerabilities affecting prior versions. The advisory covers several CVEs with a high severity rating but does not provide detailed technical information or exploitation methods. Users of versions before 1.6.4 are advised to upgrade to mitigate these issues.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs that includes an update to the Trivy package addressing vulnerabilities identified as CVE-2026-71556 and CVE-2026-15789. These vulnerabilities relate to security weaknesses classified under CWE-22 (Path Traversal) and CWE-59 (Link Following). The update includes version 0.74.0-0.2.hum1 of Trivy for aarch64 and x86_64 architectures. No explicit patch details are provided beyond the availability of this update.

A medium severity vulnerability (CVE-2026-15789) affecting Red Hat Hardened Images RPMs related to podman packages has been addressed by Red Hat. The issue involves a path traversal weakness (CWE-22) in podman versions 6.0.2-2.3.hum1 on aarch64 and x86_64 architectures. Red Hat has released updated RPM packages that fix this vulnerability. Users of the affected podman packages should apply the provided updates to mitigate the risk.

This update includes the following RPMs: buildah: * buildah-1.45.0-2.hum1 (aarch64, x86_64) * buildah-1.45.0-2.hum1.src (src) Security Fix(es): buildah: * CVE-2026-15788 * CVE-2026-56852

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.