huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Kafka JNDI Login Module RCE Vulnerability
CVE: CVE-2025-27819
Component: org.apache.kafka
CWE: CWE-502
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-06-10T07:54:41.896000+00:00

A flaw was found in org.apache.kafka. The JndiLoginModule within the SASL authentication mechanism allows remote code execution and denial of service when misconfigured. This flaw allows an attacker to provide a malicious JNDI URI within the Kafka broker's configuration, permitting arbitrary code execution on the affected system.

Statement: No Red Hat products or offerings are affected by this vulnerability.

This vulnerability is categorized as Important rather than Moderate due to its potential to enable remote code execution (RCE) or denial of service (DoS) in a core component of Apache Kafka—its brokers—under certain but realistic conditions. While exploitation requires AlterConfigs permission and network access to the Kafka cluster, these privileges are commonly granted to administrative or automation accounts in real-world deployments. The core issue arises from unsafe JAAS configuration allowing the use of JndiLoginModule, which can trigger JNDI lookups and result in arbitrary code execution if a malicious LDAP or RMI server is referenced. Given Kafka's central role in data pipelines and real-time processing systems, a successful exploit could lead to a full cluster compromise, service disruption, or even lateral movement within a network.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To mitigate this flaw, disable the problematic login module's usage in the SASL JAAS configuration using the system property, "-Dorg.apache.kafka.disallowed.login.modules".
CVE: CVE-2025-2018
Component: Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability
Release date: 2025-03-10T22:01:02.631000+00:00

Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25245.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Apache Jena path traversal
CVE: CVE-2025-49656
Component: org.apache.jena/jena-arq
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-07-21T09:30:32.715000+00:00

Users with administrator access can create databases files outside the files area of the Fuseki server.

This issue affects Apache Jena version up to 5.4.0.

Users are recommended to upgrade to version 5.5.0, which fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
vLLM Tool Schema denial of service
CVE: CVE-2025-48944
Component: vllm
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-30T18:38:45.505000+00:00

A denial of service flaw was found in vLLM. This flaw allows a remote attacker with access to /v1/chat/completions OpenAPI endpoint to submit malformed data in the "pattern" and "type" fields to crash the vLLM instance.

Statement: The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to the application layer, without compromising the underlying system stability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Langchain indirect propmpt injection
CVE: CVE-2025-46059
Component: langchain-core
CWE: CWE-94
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2025-07-29T00:00:00+00:00

A prompt injection vulnerability was found in the Langchain AI project. Users who leverage the GmailToolkit component are at risk of an attacker creating a malicious email. This vulnerability could allow code execution in the context of the running Python application.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: irqchip/gic-v2m use-after-free vulnerability
CVE: CVE-2025-37819
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-08T00:00:00+00:00

A flaw was found in the Linux kernel's irqchip/gic-v2m component. This vulnerability allows a use-after-free condition via gicv2m_get_fwnode() being wrongly marked as __init, causing it to be freed while still registered with the PCI (Peripheral Component Interconnect) subsystem during a PCI host bridge probe.

Statement: A use-after-free flaw was found in the Linux kernel irqchip/gic-v2m module during a PCI host bridge probe, where a privileged user (PR:H) may access a callback which is already freed with the PCI
subsystem leading to a DoS and kernel information leak problem.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Argo Workflows Zip Slip
CVE: CVE-2025-62156
Component: github.com/argoproj/argo-workflows
CWE: CWE-22
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Release date: 2025-10-14T14:52:44.502000+00:00

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archive entry can supply a traversal or absolute path that, after cleaning, overrides the destination directory and causes files to be written outside the /work/tmp extraction path and into system directories such as /etc inside the container. The vulnerability enables arbitrary file creation or overwrite in system configuration locations (for example /etc/passwd, /etc/hosts, /etc/crontab), which can lead to privilege escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue.


Remediation:
For Red Hat OpenShift AI 2.22.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Catalyst::Plugin::Session generates session ids insecurely
CVE: CVE-2025-40924
Component: catalyst-plugin-session
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-07-17T13:33:43.739000+00:00

A session id generation flaw has been discovered in the Catalyst::Plugin::Session Perl module. The session id is generated from a hash (usually SHA-1) of a simple counter, the epoch time, the built-in rand function, the PID, and the current Catalyst context. This information is of low entropy. The PID will come from a small set of numbers, and the epoch time may be guessed if it is not leaked from the HTTP Date header. Predicable session ids could allow an attacker to gain access to systems.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout
CVE: CVE-2025-1634
Component: io.quarkus
CWE: CWE-401
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-24T00:00:00+00:00

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.

Statement: This vulnerability is marked as and Important severity rather than Moderate because it allows an unauthenticated attacker to trigger a denial of service  condition by repeatedly sending crafted HTTP requests with low timeouts. The issue leads to a memory leak that cannot be recovered without restarting the application, ultimately resulting in an OutOfMemoryError  and complete service failure.

In a production environment, this vulnerability poses a significant risk to availability, especially for applications handling multiple concurrent requests. Since no mitigation exists, all applications using quarkus-resteasy are affected until patched. The ease of exploitation, lack of required privileges, and high impact on service uptime justify the high severity rating.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).
Before applying this update, ensure that all previously released errata relevant to your system are applied.  

For details about applying this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect
CVE: CVE-2025-4123
Component: grafana
CWE: CWE-79
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Release date: 2025-05-15T03:49:32.464000+00:00

A flaw was found in Grafana's custom frontend plugin handling. This vulnerability allows an attacker to perform a cross-site scripting (XSS) attack by exploiting a client path traversal and an open redirect issue, leading to arbitrary JavaScript execution and potential user redirection to malicious websites. This attack can be carried out without requiring elevated privileges if anonymous access is enabled.

Statement: This Grafana vulnerability is Important due to its low exploitation barrier and high impact. Unlike typical XSS flaws, it can be triggered without authentication if anonymous access is enabled—a common setup in shared dashboards. It arises from improper handling of user-supplied paths in custom frontend plugins, leading to XSS and open redirect. When combined with the Grafana Image Renderer plugin, it enables full-read SSRF, exposing internal services and cloud metadata. This makes it a high-severity issue with serious real-world implications, especially in misconfigured or publicly exposed Grafana instances.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ppp: Fix KMSAN uninit-value warning with bpf
CVE: CVE-2025-21922
Component: kernel
CWE: CWE-908
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ppp: Fix KMSAN uninit-value warning with bpf

Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the
ppp driver not initializing a 2-byte header when using socket filter.

The following code can generate a PPP filter BPF program:
'''
struct bpf_program fp;
pcap_t *handle;
handle = pcap_open_dead(DLT_PPP_PPPD, 65535);
pcap_compile(handle, &fp, "ip and outbound", 0, 0);
bpf_dump(&fp, 1);
'''
Its output is:
'''
(000) ldh [2]
(001) jeq #0x21 jt 2 jf 5
(002) ldb [0]
(003) jeq #0x1 jt 4 jf 5
(004) ret #65535
(005) ret #0
'''
Wen can find similar code at the following link:
https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680
The maintainer of this code repository is also the original maintainer
of the ppp driver.

As you can see the BPF program skips 2 bytes of data and then reads the
'Protocol' field to determine if it's an IP packet. Then it read the first
byte of the first 2 bytes to determine the direction.

The issue is that only the first byte indicating direction is initialized
in current ppp driver code while the second byte is not initialized.

For normal BPF programs generated by libpcap, uninitialized data won't be
used, so it's not a problem. However, for carefully crafted BPF programs,
such as those generated by syzkaller [2], which start reading from offset
0, the uninitialized data will be used and caught by KMSAN.

[1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791
[2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000


Remediation:
Bouncy Castle for Java FIPS: Denial of Service via excessive memory allocation
CVE: CVE-2025-9341
Component: org.bouncycastle/bc-fips
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-22T09:09:17.111000+00:00

A flaw was found in Bouncy Castle for Java FIPS. This uncontrolled resource consumption vulnerability allows an attacker to cause a Denial of Service (DoS) by triggering excessive memory allocation. This can lead to the affected system becoming unresponsive or crashing due to resource exhaustion.

Statement: This vulnerability is rated Moderate. In the Red Hat context, impact is limited as the vulnerable code is not present in Red Hat Enterprise Application Platform versions eap-8.0.z, eap-8.1.z, and eapxp-5.

Remediation:
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
CVE: CVE-2025-54988
Component: org.apache.tika/tika-parser-pdf-module
CWE: CWE-611
Severity: Critical
CVSS v3: 9.3/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-08-20T20:08:49.481000+00:00

An XML External Entity injection flaw was found in the Apache Tika tika-parser-pdf-module. This vulnerability allows an attacker to provide a crafted XFA file within a PDF, read sensitive data, or trigger malicious requests to internal resources or third-party servers.

Statement: Within Red Hat products, the tika-parser-pdf-module is exclusively used for testing purposes at build time, it is not included in any shipped releases of Camel Spring Boot or JBoss EAP.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Potential local code execution in "copy as cURL" command
CVE: CVE-2025-4089
Component: firefox
CWE: CWE-138
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-04-29T13:13:45.152000+00:00

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 138 and Thunderbird < 138.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ClamAV PDF Scanning Buffer Overflow Vulnerability
CVE: CVE-2025-20260
Component: clamav
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-06-18T17:08:36.207000+00:00

A vulnerability has been discovered in the PDF parsing engine of ClamAV. This flaw can be exploited to achieve remote code execution (RCE). Given that ClamAV is routinely used to process untrusted input (for example, email attachments and downloaded files), a malicious PDF document could trigger this vulnerability, allowing an attacker to execute arbitrary code on the system running ClamAV.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to memory corruption
CVE: CVE-2025-24223
Component: webkitgtk
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-05-15T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service
CVE: CVE-2025-61795
Component: tomcat
CWE: CWE-404
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-27T17:30:28.334000+00:00

A denial of service flaw has been discovered in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Starlette denial-of-service
CVE: CVE-2025-54121
Component: starlette
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-21T20:06:03.818000+00:00

A denial of service flaw was found in the Starlette ASGI framework. This flaw allows a remote attacker to submit a specially crafted multi-part form with large files. This can exhaust the server's resources, which may block the main thread pool and lead to a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
CVE: CVE-2025-39942
Component: kernel
Severity: None
Release date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size

This is inspired by the check for data_offset + data_length.


Remediation: