Threats Tagged 'cve-2026-44431'

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5789-5fc7-67v3. This link is maintained to preserve external references. ### Original Description A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to multiple llvm21-related packages. The advisory addresses several vulnerabilities identified by CVE identifiers CVE-2026-13573, CVE-2026-13574, CVE-2026-44432, and CVE-2026-45149. These vulnerabilities relate to issues categorized under CWEs such as buffer overflows and race conditions. The update provides bug fixes and enhancements to the affected RPM packages for aarch64 and x86_64 architectures. No known exploits in the wild have been reported. The advisory does not explicitly state fixed versions or detailed patch instructions but references Red Hat's update channels for applying the fixes.

This update includes the following RPMs: trivy: * trivy-0.72.0-0.1.hum1 (aarch64, x86_64) * trivy-0.72.0-0.1.hum1.src (src) Security Fix(es): trivy: * CVE-2026-46680 * CVE-2026-47262 * CVE-2026-53488

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.