{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.22.10 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.22.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.22.10. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHBA-2026:54768\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nSecurity Fix(es):\n\n* kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU\ncache isolation (CVE-2025-54518)\n* samba: Missing access check on reparse point operations (CVE-2026-1933)\n* sssd: sssd: sudo LDAP provider searches entire directory tree for\nsudoRole objects by default, enabling privilege escalation (CVE-2026-14474)\n* sg3_utils: sg3_utils: arbitrary command execution via udev property\ninjection in sg_inq --export (CVE-2026-16313)\n* rsync: TOCTOU symlink race condition allowing local privilege escalation\nin daemon mode without chroot. (CVE-2026-29518)\n* unbound: Unbound: Denial of Service via excessive EDNS options\n(CVE-2026-41292)\n* vim: Vim: Arbitrary Code Execution via crafted directory names\n(CVE-2026-47162)\n* vim: Vim: Arbitrary code execution via crafted step-definition patterns\n(CVE-2026-47167)\n* vim: Vim: Arbitrary code execution via Python omni-completion\n(CVE-2026-52858)\n* acl: Symlink traversal privilege escalation via libacl functions\n(CVE-2026-54369)\n* vim: Vim: Arbitrary code execution via malicious docstrings in Python\nomni-completion (CVE-2026-57456)\n* openssh: OpenSSH: Use-after-free vulnerability during host key\nre-exchange on the client side (CVE-2026-60002)\n* kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace\nI/O (CVE-2025-40026)\n* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via\ndangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n* sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath\nallows Kerberos authentication bypass (CVE-2026-14476)\n* unbound: Unbound: Cache manipulation via \u0027ghost domain names\u0027 attack\n(CVE-2026-40622)\n* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)\n* vim: Vim: Denial of Service via stack out-of-bounds write in\nspell_soundfold_sofo() (CVE-2026-57455)\n* vim: Vim: Arbitrary code execution via crafted PHP file in\nomni-completion (CVE-2026-59856)\n* vim: Vim: Arbitrary command execution via crafted tags file in C\nomni-completion (CVE-2026-59858)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:54769",
        "url": "https://access.redhat.com/errata/RHSA-2026:54769"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2406712",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406712"
      },
      {
        "category": "external",
        "summary": "2447317",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447317"
      },
      {
        "category": "external",
        "summary": "2469055",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469055"
      },
      {
        "category": "external",
        "summary": "2477784",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477784"
      },
      {
        "category": "external",
        "summary": "2480125",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480125"
      },
      {
        "category": "external",
        "summary": "2480127",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480127"
      },
      {
        "category": "external",
        "summary": "2487964",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
      },
      {
        "category": "external",
        "summary": "2490277",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
      },
      {
        "category": "external",
        "summary": "2492968",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
      },
      {
        "category": "external",
        "summary": "2492972",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
      },
      {
        "category": "external",
        "summary": "2492980",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
      },
      {
        "category": "external",
        "summary": "2493411",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
      },
      {
        "category": "external",
        "summary": "2496556",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496556"
      },
      {
        "category": "external",
        "summary": "2496581",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496581"
      },
      {
        "category": "external",
        "summary": "2497936",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497936"
      },
      {
        "category": "external",
        "summary": "2498867",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
      },
      {
        "category": "external",
        "summary": "2498868",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
      },
      {
        "category": "external",
        "summary": "2502845",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-105444",
        "url": "https://issues.redhat.com/browse/OCPBUGS-105444"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54769.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.22.10 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-08-19T01:35:39+00:00",
      "generator": {
        "date": "2026-08-19T01:35:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:54769",
      "initial_release_date": "2026-08-18T12:26:11+00:00",
      "revision_history": [
        {
          "date": "2026-08-18T12:26:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-18T12:26:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-19T01:35:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.22",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.22",
                  "product_id": "9Base-RHOSE-4.22",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.22::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-4.22.9.8.202608130832-0",
                "product": {
                  "name": "rhcos-aarch64-4.22.9.8.202608130832-0",
                  "product_id": "rhcos-aarch64-4.22.9.8.202608130832-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608130832?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-4.22.9.8.202608130832-0",
                "product": {
                  "name": "rhcos-ppc64le-4.22.9.8.202608130832-0",
                  "product_id": "rhcos-ppc64le-4.22.9.8.202608130832-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608130832?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-4.22.9.8.202608130832-0",
                "product": {
                  "name": "rhcos-s390x-4.22.9.8.202608130832-0",
                  "product_id": "rhcos-s390x-4.22.9.8.202608130832-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608130832?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-4.22.9.8.202608130832-0",
                "product": {
                  "name": "rhcos-x86_64-4.22.9.8.202608130832-0",
                  "product_id": "rhcos-x86_64-4.22.9.8.202608130832-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@4.22.9.8.202608130832?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-4.22.9.8.202608130832-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0"
        },
        "product_reference": "rhcos-aarch64-4.22.9.8.202608130832-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-4.22.9.8.202608130832-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0"
        },
        "product_reference": "rhcos-ppc64le-4.22.9.8.202608130832-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-4.22.9.8.202608130832-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0"
        },
        "product_reference": "rhcos-s390x-4.22.9.8.202608130832-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-4.22.9.8.202608130832-0 as a component of Red Hat OpenShift Container Platform 4.22",
          "product_id": "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        },
        "product_reference": "rhcos-x86_64-4.22.9.8.202608130832-0",
        "relates_to_product_reference": "9Base-RHOSE-4.22"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-40026",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "discovery_date": "2025-10-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406712"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O\n\nWhen completing emulation of instruction that generated a userspace exit\nfor I/O, don\u0027t recheck L1 intercepts as KVM has already finished that\nphase of instruction execution, i.e. has already committed to allowing L2\nto perform I/O.  If L1 (or host userspace) modifies the I/O permission\nbitmaps during the exit to userspace,  KVM will treat the access as being\nintercepted despite already having emulated the I/O access.\n\nPivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation.\nOf the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the\nintended \"recipient\") can reach the code in question.  gp_interception()\u0027s\nuse is mutually exclusive with is_guest_mode(), and\ncomplete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with\nEMULTYPE_SKIP.\n\nThe bad behavior was detected by a syzkaller program that toggles port I/O\ninterception during the userspace I/O exit, ultimately resulting in a WARN\non vcpu-\u003earch.pio.count being non-zero due to KVM no completing emulation\nof the I/O instruction.\n\n  WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm]\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm]\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_fast_pio+0xd6/0x1d0 [kvm]\n   vmx_handle_exit+0x149/0x610 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm]\n   kvm_vcpu_ioctl+0x244/0x8c0 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0x5d/0xc60\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "KVM x86 was re-checking L1 instruction intercepts while completing a userspace I/O emulation for an L2 instruction. If L1 (or host userspace) modified I/O interception during the exit, KVM could wrongly treat the already-emulated I/O as intercepted and leave vcpu-\u003earch.pio.count non-zero, triggering a WARN and potentially disrupting the guest.\nPractical exploitation requires local access to /dev/kvm and the ability to run nested virtualization or manipulate I/O bitmaps.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-40026"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406712",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406712"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-40026",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-40026"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-40026",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40026"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T"
        }
      ],
      "release_date": "2025-10-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "This vulnerability can be mitigated by disabling nested virtualization. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53359-mitigation.conf`. In that file, disable nested virtualization for the `kvm_intel` and `kvm_amd` kernel modules:\n```\noptions kvm-intel nested=0\noptions kvm-amd nested=0\n```\n\nUse `lsmod` to determine if either module is already loaded. If so, remove loaded modules with `modprobe -r`. To validate that nested virtualization is disabled, read the files `/sys/module/kvm_intel/parameters/nested` and `/sys/module/kvm_amd/parameters/nested`. If these modules are loaded, those files should read `N` to indicate that the feature is disabled.\n\nIn OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example.\n\nhttps://access.redhat.com/solutions/6979679",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O"
    },
    {
      "cve": "CVE-2025-54518",
      "cwe": {
        "id": "CWE-1220",
        "name": "Insufficient Granularity of Access Control"
      },
      "discovery_date": "2026-05-15T05:01:27.379831+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477784"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in AMD Zen 2-based processors, affecting components such as the kernel and Xen hypervisor. Improper isolation of shared resources within the CPU operation cache could allow an attacker to corrupt instructions executed at a different privilege level. This could potentially result in privilege escalation, granting an attacker higher system access than intended.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-54518"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477784",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477784"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-54518",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-54518"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-54518",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54518"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/05/12/15",
          "url": "http://www.openwall.com/lists/oss-security/2026/05/12/15"
        },
        {
          "category": "external",
          "summary": "http://xenbits.xen.org/xsa/advisory-490.html",
          "url": "http://xenbits.xen.org/xsa/advisory-490.html"
        },
        {
          "category": "external",
          "summary": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.html",
          "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.html"
        }
      ],
      "release_date": "2026-05-15T03:06:30.822000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Asim Viladi Oglu Manizada"
          ]
        }
      ],
      "cve": "CVE-2026-1933",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2026-03-13T08:29:39.852000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447317"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Samba\u2019s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "samba: Missing access check on reparse point operations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important severity by Red Hat Product Security, because authenticated users with filesystem-level write permissions may bypass Samba\u2019s SMB-layer read-only protections for reparse point operations.\n\nThe flaw affects shares configured with \"read only = yes\", where Samba failed to properly enforce access checks when setting or deleting reparse point metadata. An attacker with existing write permissions on the underlying filesystem may manipulate SMB reparse point metadata to alter how files are presented to SMB clients, including converting files into symbolic links.\n\nThe vulnerability does not bypass underlying filesystem access controls or grant additional operating system privileges. However, successful exploitation may significantly disrupt file access for users of the affected share, including making large portions of a shared filesystem unavailable through widespread reparse point modification. Because the attack requires authenticated access and existing filesystem write permissions, Privileges Required are assessed as Low (PR:L).\n\n```\n\nThis vulnerability affects Samba versions beginning with the introduction of NTFS-style reparse point support in Samba 4.21.\n\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1933"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447317",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447317"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1933",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1933"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1933",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1933"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.samba.org/show_bug.cgi?id=15992",
          "url": "https://bugzilla.samba.org/show_bug.cgi?id=15992"
        }
      ],
      "release_date": "2026-05-27T12:08:33.095000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Administrators can mitigate this issue by ensuring users who access a read only = yes Samba share do not have filesystem-level write permission to the exported files.\n\nA server administrator may also monitor and remove unintended \"user.SmbReparse\" xattr (extended attributes) and the associated FILE_ATTRIBUTE_REPARSE_POINT \"user.DosAttrib\" bit metadata if exploitation is suspected.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "samba: Missing access check on reparse point operations"
    },
    {
      "cve": "CVE-2026-14164",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-06-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/issues/3069",
          "url": "https://github.com/libarchive/libarchive/issues/3069"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/3071",
          "url": "https://github.com/libarchive/libarchive/pull/3071"
        }
      ],
      "release_date": "2026-05-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ian Murphy"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-14474",
      "cwe": {
        "id": "CWE-1188",
        "name": "Initialization of a Resource with an Insecure Default"
      },
      "discovery_date": "2026-04-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496556"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SSSD\u0027s LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this as Important because the attack requires only low-privilege delegated LDAP write access to any subtree, which is a common delegation pattern in enterprise environments. The default ldap_sudo_search_base configuration searches the entire directory tree, allowing sudo rule injection from outside the intended sudoers container.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14474"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496556",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496556"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14474",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14474"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14474",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14474"
        }
      ],
      "release_date": "2026-07-07T09:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Set ldap_sudo_search_base explicitly in /etc/sssd/sssd.conf to restrict the search to the designated sudoers container:\n\n[domain/example.com] ldap_sudo_search_base = ou=sudoers,dc=example,dc=com\n\nAdditionally, restrict LDAP ACLs to prevent non-admin principals from creating sudoRole objects outside the designated sudoers container.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ian Murphy"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-14476",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "discovery_date": "2026-04-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496581"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A path traversal flaw was found in SSSD\u0027s AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this as Moderate because exploitation requires high privileges (AD GPO management access) and on default RHEL configurations with SELinux enforcing, the realistic impact is limited to Kerberos authentication bypass via krb5 configuration injection. SELinux blocks writes to most security-critical paths such as /etc/cron.d/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14476"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496581",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496581"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14476",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14476"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14476",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14476"
        }
      ],
      "release_date": "2026-07-07T09:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shaomin Chen"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-16313",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-06-01T18:13:24+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502845"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "sg3_utils versions 1.34 through 1.48 contain a command injection flaw in the export_dev_ids() function of sg_inq. When sg_inq --export processes SCSI device identification data from VPD page 0x83, the SCSI name string designator (type 8) and the ATA vendor-ID subfield are printed without sanitizing embedded control characters. A crafted SCSI/USB device can embed a newline in this field, splitting sg_inq\u0027s udev KEY=VALUE output into two lines and injecting an arbitrary udev property, including REMOVE_CMD. On systems whose default udev rules invoke sg_inq --export for SCSI device identification and act on REMOVE_CMD when a device is removed, this allows a local attacker with physical access to a USB/SCSI port to achieve arbitrary command execution as root simply by disconnecting the crafted device.\n\nExploitation requires physical access to attach the malicious device, consistent with Red Hat\u0027s Physical (AV:P) attack vector scoring. The upstream fix (udev-conforming character escaping for this field) has not yet been included in any tagged sg3_utils release; all Red Hat-shipped versions of sg3_utils in the 1.34-1.48 range are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502845",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "https://github.com/doug-gilbert/sg3_utils/pull/83",
          "url": "https://github.com/doug-gilbert/sg3_utils/pull/83"
        }
      ],
      "release_date": "2026-06-01T18:13:24+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Remove or comment out the REMOVE_CMD rule from 50-udev-default.rules to prevent command execution on device removal. Alternatively, if automatic SCSI device identification is not required, disable the udev rule that invokes sg_inq --export on device connection.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export"
    },
    {
      "cve": "CVE-2026-29518",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-05-11T13:09:31.417000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2469055"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in rsync. An rsync daemon configured with \"use chroot = no\" is exposed\nto a time-of-check / time-of-use race on parent path components. A local\nattacker with write access to a module can replace a parent directory\ncomponent with a symlink between the receiver\u0027s check and its open(),\nredirecting reads (basis-file disclosure) and writes (file overwrite)\noutside the module. Under elevated daemon privilege this allows privilege\nescalation. Default \"use chroot = yes\" is not exposed.\nReach: local attacker on the daemon host, write access to a module path,\ndaemon configured with use chroot = no.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw, a Time-of-Check Time-of-Use (TOCTOU) race condition, allows a local attacker with write access to an rsync module path to achieve privilege escalation. This vulnerability specifically impacts rsync daemons configured with `use chroot = no`. Red Hat\u0027s default rsync daemon configuration utilizes `use chroot = yes`, which is not susceptible to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29518"
        },
        {
          "category": "external",
          "summary": "RHBZ#2469055",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469055"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29518",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29518"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29518",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29518"
        }
      ],
      "release_date": "2026-05-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "To prevent exploitation, ensure the rsync daemon is configured with `use chroot = yes`. This setting, which is the default, isolates the rsync process and prevents the symlink race condition. If `use chroot = no` is present in the rsync configuration (e.g., `/etc/rsyncd.conf`), it must be changed to `use chroot = yes`. A restart of the rsync service is required for any configuration changes to take effect.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot."
    },
    {
      "cve": "CVE-2026-40622",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-05-20T10:01:04.404024+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480127"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NLnet Labs Unbound. A remote attacker, by controlling a malicious domain (a \"ghost zone\") and querying a vulnerable Unbound server, could exploit a vulnerability related to \"ghost domain names\" attacks. This could allow the attacker to overwrite cached Name Server (NS) records, extending the \"ghost domain window\" by up to one cached Time To Live (TTL) value. This manipulation could lead to cache poisoning, potentially causing the Unbound server to serve incorrect or malicious DNS information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "unbound: Unbound: Cache manipulation via \u0027ghost domain names\u0027 attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40622"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480127",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480127"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40622",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40622"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40622",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40622"
        },
        {
          "category": "external",
          "summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt",
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt"
        }
      ],
      "release_date": "2026-05-20T09:18:41.816000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "unbound: Unbound: Cache manipulation via \u0027ghost domain names\u0027 attack"
    },
    {
      "cve": "CVE-2026-41292",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-05-20T10:00:54.433285+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480125"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Unbound. A remote attacker can exploit this vulnerability by sending queries with an excessive number of EDNS (Extension Mechanisms for DNS) options. This can cause Unbound threads to be held hostage while parsing and creating internal data structures for these options. Coordinated attacks can lead to resource exhaustion, resulting in a degradation of service or a denial of service (DoS) for legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "unbound: Unbound: Denial of Service via excessive EDNS options",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480125",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480125"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41292"
        },
        {
          "category": "external",
          "summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt",
          "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt"
        }
      ],
      "release_date": "2026-05-20T09:19:13.022000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "unbound: Unbound: Denial of Service via excessive EDNS options"
    },
    {
      "cve": "CVE-2026-47162",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-06-11T19:00:56.050612+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via crafted directory names",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47162",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b",
          "url": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0495",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0495"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c"
        }
      ],
      "release_date": "2026-06-11T18:32:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via crafted directory names"
    },
    {
      "cve": "CVE-2026-47167",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:02:45.999423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487996"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted step-definition patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s cucumber filetype plugin, when configured with Ruby support, allows for arbitrary code execution. An attacker could exploit this by convincing a user to open a specially crafted repository and trigger a specific step-jump mapping, leading to local command execution. This risk is contingent on user interaction with untrusted content and the presence of the Ruby-enabled cucumber plugin.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487996",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487996"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47167",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934",
          "url": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0496",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0496"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"
        }
      ],
      "release_date": "2026-06-11T18:31:44.286000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted step-definition patterns"
    },
    {
      "cve": "CVE-2026-52858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:01:57.042099+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487981"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user\u0027s system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487981",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487981"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-52858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d",
          "url": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0561",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0561"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c"
        }
      ],
      "release_date": "2026-06-11T18:32:32.722000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via Python omni-completion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Andrew Tridgell \u003ctridge60@gmail.com\u003e",
            "Alexander Peslyak \u003csolar@openwall.com\u003e"
          ]
        }
      ],
      "cve": "CVE-2026-54369",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-06-16T23:47:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acl: Symlink traversal privilege escalation via libacl functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54369"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490277",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
        }
      ],
      "release_date": "2026-06-29T13:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "acl: Symlink traversal privilege escalation via libacl functions"
    },
    {
      "cve": "CVE-2026-55693",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-25T16:02:21.870241+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Out-of-bounds Write in Spell File Word Count",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Vim\u0027s spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a malicious file, limiting its immediate exploitability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55693",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
          "url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0653",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
        }
      ],
      "release_date": "2026-06-25T15:34:33.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Out-of-bounds Write in Spell File Word Count"
    },
    {
      "cve": "CVE-2026-57455",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-25T16:01:18.343208+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492968"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492968",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57455",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        }
      ],
      "release_date": "2026-06-25T15:22:37.949000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()"
    },
    {
      "cve": "CVE-2026-57456",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-25T16:01:37.648886+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492972"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important. A vulnerability in Vim\u0027s Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492972",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57456",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        }
      ],
      "release_date": "2026-06-25T15:16:16.015000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion"
    },
    {
      "cve": "CVE-2026-59856",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:40.406872+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk.\"",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59856",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
          "url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
        }
      ],
      "release_date": "2026-07-09T22:39:01.803000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion"
    },
    {
      "cve": "CVE-2026-59858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:43.278752+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A command injection vulnerability in Vim\u0027s C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Vim\u0027s C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
          "url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
        }
      ],
      "release_date": "2026-07-09T22:37:52.789000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion"
    },
    {
      "cve": "CVE-2026-60002",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-07-08T01:01:33.808610+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497936"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
          "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497936",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497936"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-60002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:17:33.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T12:26:11+00:00",
          "details": "For OpenShift Container Platform 4.22 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is\nsha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490\n\n      (For s390x architecture)\n      The image digest is\nsha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf\n\n      (For ppc64le architecture)\n      The image digest is\nsha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e\n\n      (For aarch64 architecture)\n      The image digest is\nsha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54769"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.",
          "product_ids": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202608130832-0",
            "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202608130832-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side"
    }
  ]
}