Threats Tagged 'cve-2026-67322'

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.

This update for python-Django fixes the following issues: Changes in python-Django: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups (bsc#1272997) - CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (bsc#1272998) - CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (bsc#1272999) - CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (bsc#1273000)

This vulnerability concerns multiple security issues fixed in the python313-GitPython-3.1.58-1.1 package on openSUSE Tumbleweed and related Red Hat Hardened Images RPMs. The issues are identified by CVE-2026-67322 and related CVEs, involving several CWE categories such as improper authentication and command injection. The update includes fixes in various LLVM and Clang related packages distributed by Red Hat. No known exploits are reported in the wild. The severity is assessed as medium.

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.

This update includes the following RPMs: swift-lang: * swift-lang-6.3.3-0.1.1.hum1 (aarch64, x86_64) * swift-lang-runtime-6.3.3-0.1.1.hum1 (aarch64, x86_64) * swift-lang-6.3.3-0.1.1.hum1.src (src) Security Fix(es): swift-lang: * CVE-2026-43823

This update includes the following RPMs: llvm: * clang-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-analyzer-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-libs-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-resource-filesystem-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-tools-extra-22.1.8-4.1.hum1 (aarch64, x86_64) * clang-tools-extra-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * compiler-rt-22.1.8-4.1.hum1 (aarch64, x86_64) * git-clang-format-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxx-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxx-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxx-static-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxxabi-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxxabi-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * libcxxabi-static-22.1.8-4.1.hum1 (aarch64, x86_64) * libomp-22.1.8-4.1.hum1 (aarch64, x86_64) * libomp-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * lld-22.1.8-4.1.hum1 (aarch64, x86_64) * lld-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * lld-libs-22.1.8-4.1.hum1 (aarch64, x86_64) * lldb-22.1.8-4.1.hum1 (aarch64, x86_64) * lldb-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-bolt-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-cmake-utils-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-doc-22.1.8-4.1.hum1 (noarch) * llvm-filesystem-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-googletest-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libs-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libunwind-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libunwind-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-libunwind-static-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-static-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-test-22.1.8-4.1.hum1 (aarch64, x86_64) * polly-22.1.8-4.1.hum1 (aarch64, x86_64) * polly-devel-22.1.8-4.1.hum1 (aarch64, x86_64) * python3-clang-22.1.8-4.1.hum1 (aarch64, x86_64) * python3-lit-22.1.8-4.1.hum1 (noarch) * python3-lldb-22.1.8-4.1.hum1 (aarch64, x86_64) * llvm-22.1.8-4.1.hum1.src (src)