huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ipvs: fix ipv4 null-ptr-deref in route error path
CVE: CVE-2025-68813
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's IPVS (IP Virtual Server) implementation. In __ip_vs_get_out_rt(), when route lookup fails, dst_link_failure() is called with skb->dev set to NULL. The subsequent call chain through ipv4_link_failure() to fib_compute_spec_dst() dereferences skb->dev, causing a kernel crash when IPVS processes packets in NAT mode with a misconfigured destination.

Statement: This vulnerability affects systems using IPVS for load balancing with NAT mode. The crash occurs when route lookup fails before establishing a route, typically due to misconfiguration. The issue was discovered by KASAN and syzkaller. Prior partial fixes addressed some NULL dereferences but not all code paths.

Remediation:
To mitigate this issue, prevent the ip_vs module from being loaded if IPVS load balancing functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
Linux kernel: SCTP use-after-free due to race condition in sendmsg
CVE: CVE-2025-23142
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:H
Release date: 2025-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's SCTP implementation. This vulnerability allows a use-after-free read via a race condition during SCTP message sending.

Statement: This is a MODERATE impact use-after-free flaw,found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This race condition occurs during message sending,the kernel function sctp_sendmsg() sends SCTP messages by selecting a transport (network path) and associating it with message chunks.
If another thread removes that transport (e.g., by unbinding an address using setsockopt(SCTP_SOCKOPT_BINDX_REM)) after the transport has been selected but before the message is sent, the code can end up accessing a transport that has been freed from memory, leading to a use after free. Red Hat Enterprise Linux 9 is affected. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are not affected as the vulnerable code is not present.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use anhd deployment, applicability to widespread installation base or stability.
fs: quota: create dedicated workqueue for quota_release_work
CVE: CVE-2025-40196
Component: kernel
CWE: CWE-821
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fs: quota: create dedicated workqueue for quota_release_work

There is a kernel panic due to WARN_ONCE when panic_on_warn is set.

This issue occurs when writeback is triggered due to sync call for an
opened file(ie, writeback reason is WB_REASON_SYNC). When f2fs balance
is needed at sync path, flush for quota_release_work is triggered.
By default quota_release_work is queued to "events_unbound" queue which
does not have WQ_MEM_RECLAIM flag. During f2fs balance "writeback"
workqueue tries to flush quota_release_work causing kernel panic due to
MEM_RECLAIM flag mismatch errors.

This patch creates dedicated workqueue with WQ_MEM_RECLAIM flag
for work quota_release_work.

------------[ cut here ]------------
WARNING: CPU: 4 PID: 14867 at kernel/workqueue.c:3721 check_flush_dependency+0x13c/0x148
Call trace:
 check_flush_dependency+0x13c/0x148
 __flush_work+0xd0/0x398
 flush_delayed_work+0x44/0x5c
 dquot_writeback_dquots+0x54/0x318
 f2fs_do_quota_sync+0xb8/0x1a8
 f2fs_write_checkpoint+0x3cc/0x99c
 f2fs_gc+0x190/0x750
 f2fs_balance_fs+0x110/0x168
 f2fs_write_single_data_page+0x474/0x7dc
 f2fs_write_data_pages+0x7d0/0xd0c
 do_writepages+0xe0/0x2f4
 __writeback_single_inode+0x44/0x4ac
 writeback_sb_inodes+0x30c/0x538
 wb_writeback+0xf4/0x440
 wb_workfn+0x128/0x5d4
 process_scheduled_works+0x1c4/0x45c
 worker_thread+0x32c/0x3e8
 kthread+0x11c/0x1b0
 ret_from_fork+0x10/0x20
Kernel panic - not syncing: kernel: panic_on_warn set ...

Statement: Quota release work is queued to events_unbound (no WQ_MEM_RECLAIM flag) but gets flushed during f2fs writeback from a WQ_MEM_RECLAIM context. This flag mismatch triggers workqueue dependency checks that warn about potential deadlocks—if memory reclaim needs the work to complete but the work needs memory, deadlock could occur. Systems with panic_on_warn turn this warning into a hard panic. The fix creates a dedicated quota workqueue with the proper WQ_MEM_RECLAIM flag.

Remediation:
command injection via an untrusted hostname argument
CVE: CVE-2025-47203
Component: dropbear
CVSS v3: 4.5/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2025-05-07T00:00:00+00:00

dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-11463
Component: Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability
Release date: 2025-10-16T17:49:26.721000+00:00

Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26626.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
A download’s origin may be incorrectly associated
CVE: CVE-2025-43240
Component: webkitgtk
CWE: CWE-703
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2025-07-29T23:29:26.024000+00:00

A flaw was found in WebKitGTK. A malicious website can cause the origin of a download to be incorrectly associated with the wrong site due to improper checks, allowing an attacker to trick a user into downloading a malicious file.

Statement: To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.

Remediation:
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pm
CVE: CVE-2025-27551
Component: DBIx-Class-EncodedColumn
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-03-26T11:07:43.089000+00:00

DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.

This vulnerability is associated with program files lib/DBIx/Class/EncodedColumn/Digest.pm.

This issue affects DBIx::Class::EncodedColumn until 0.00032.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
OS command injection via ct_location and fcct_location parameters
CVE: CVE-2025-10622
Component: foreman
CWE: CWE-78
Severity: Important
CVSS v3: 7.3/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-11-01T23:59:00+00:00

A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.

Statement: This vulnerability is rated Important for Red Hat Satellite due to an OS command injection flaw in the Foreman component. An authenticated user with `edit_settings` permissions can bypass client-side whitelisting for `ct_location` and `fcct_location` parameters, leading to arbitrary command execution on the underlying operating system. This affects Red Hat Satellite versions 6.15, 6.16, 6.17, and 6.18.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/updating_red_hat_satellite/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
CVE: CVE-2025-37802
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"

wait_event_timeout() will set the state of the current
task to TASK_UNINTERRUPTIBLE, before doing the condition check. This
means that ksmbd_durable_scavenger_alive() will try to acquire the mutex
while already in a sleeping state. The scheduler warns us by giving
the following warning:

do not call blocking ops when !TASK_RUNNING; state=2 set at
 [<0000000061515a6f>] prepare_to_wait_event+0x9f/0x6c0
WARNING: CPU: 2 PID: 4147 at kernel/sched/core.c:10099 __might_sleep+0x12f/0x160

mutex lock is not needed in ksmbd_durable_scavenger_alive().


Remediation:
IBM Semeru Runtime denial of service
CVE: CVE-2025-2900
Component: ibm-semeru
CWE: CWE-122
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-14T18:50:27.327000+00:00

A flaw was found in IBM Semeru Runtime. This vulnerability allows a denial of service via a crafted AES/CBC encrypted input.

Statement: This vulnerability is rated as an important severity because a denial of service vulnerability was found in IBM Semeru Runtime in its native AES/CBC encryption implementation, this is a heap-based buffer overflow caused by a defect, which can lead to a subsequent crash. This issue results in a denial of service, significantly impacting the availability of the runtime.

Remediation:
CVE: CVE-2025-3612
Component: Demtec Graphytics HTTP GET Parameter visualization cross site scripting
Release date: 2025-04-15T03:00:06.701000+00:00

A vulnerability, which was classified as problematic, was found in Demtec Graphytics 5.0.7. This affects an unknown part of the file /visualization of the component HTTP GET Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SQLite: Information Disclosure via Crafted ZIP File
CVE: CVE-2025-70873
Component: sqlite
CWE: CWE-908
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in SQLite. This information disclosure vulnerability exists within the zipfile extension, specifically in the zipfileInflate function. A remote attacker could exploit this by providing a specially crafted ZIP file. Successful exploitation could lead to the disclosure of sensitive heap memory information.


Remediation:
MinIO SFTP authentication bypass due to improperly trusted SSH key
CVE: CVE-2025-27414
Component: minio
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-02-28T21:06:58.155000+00:00

A flaw was found in MinIO. An incorrect evaluation of the SSH key used in an SFTP connection when using LDAP as an external identity provider with a user with no sshPublicKey property allows an attacker to perform any FTP operations like reading, writing, deleting and listing objects, resulting in authentication bypass and unauthorized data access.

Statement: The affected MinIO component is not shipped by any Red Hat products.

The following conditions are required to exploit this vulnerability:

MinIO server must be configured to allow SFTP access and use LDAP as an external identity provider.

Knowledge of an LDAP username that does not have the `sshPublicKey` property set.

Such an LDAP username or one of their groups must also have some MinIO access policy configured.

Remediation:
drm/xe/hmm: Don't dereference struct page pointers without notifier lock
CVE: CVE-2025-21939
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/hmm: Don't dereference struct page pointers without notifier lock

The pnfs that we obtain from hmm_range_fault() point to pages that
we don't have a reference on, and the guarantee that they are still
in the cpu page-tables is that the notifier lock must be held and the
notifier seqno is still valid.

So while building the sg table and marking the pages accesses / dirty
we need to hold this lock with a validated seqno.

However, the lock is reclaim tainted which makes
sg_alloc_table_from_pages_segment() unusable, since it internally
allocates memory.

Instead build the sg-table manually. For the non-iommu case
this might lead to fewer coalesces, but if that's a problem it can
be fixed up later in the resource cursor code. For the iommu case,
the whole sg-table may still be coalesced to a single contigous
device va region.

This avoids marking pages that we don't own dirty and accessed, and
it also avoid dereferencing struct pages that we don't own.

v2:
- Use assert to check whether hmm pfns are valid (Matthew Auld)
- Take into account that large pages may cross range boundaries
  (Matthew Auld)

v3:
- Don't unnecessarily check for a non-freed sg-table. (Matthew Auld)
- Add a missing up_read() in an error path. (Matthew Auld)

(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)


Remediation:
python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
CVE: CVE-2025-4138
Component: cpython
CWE: CWE-22
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-06-03T12:59:02.717000+00:00

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract() or TarFile.extractall() with the filter= parameter set to "data" or "tar".

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Remediation:
The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

The steps to apply the upgraded images are different depending on the installation plan approval policy you used
when installing the cert-manager Operator for Red Hat OpenShift.

- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a
new version of the Operator. No further action is required to upgrade. This is the default setting.

- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.

See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional
information.
Red Hat recommends upgrading to a fixed release of Python as soon as one is available. This vulnerability can be mitigated by rejecting links inside tarfiles that use relative references to the parent directory. The upstream advisory provides this example code:

'''
# Avoid insecure segments in link names.
for member in tar.getmembers():
    if not member.islnk():
        continue
    if os.pardir in os.path.split(member.linkname):
        raise OSError("Tarfile with insecure segment ('..') in linkname")

# Now safe to extract members with the data filter.
tar.extractall(filter="data")
'''
thunderbird: Memory safety bugs fixed in Firefox 138 and Thunderbird 138
CVE: CVE-2025-4092
Component: firefox
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-04-29T13:13:49.479000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
keys: Fix UAF in key_put()
CVE: CVE-2025-21893
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-03-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

keys: Fix UAF in key_put()

Once a key's reference count has been reduced to 0, the garbage collector
thread may destroy it at any time and so key_put() is not allowed to touch
the key after that point.  The most key_put() is normally allowed to do is
to touch key_gc_work as that's a static global variable.

However, in an effort to speed up the reclamation of quota, this is now
done in key_put() once the key's usage is reduced to 0 - but now the code
is looking at the key after the deadline, which is forbidden.

Fix this by using a flag to indicate that a key can be gc'd now rather than
looking at the key's refcount in the garbage collector.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Chromium use after free vulnerability
CVE: CVE-2025-6555
Component: chromium-browser
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-06-24T20:03:31.170000+00:00

A use after free vulnerability has been discovered in the animation subsystem in Chromium. A malformed HTML page may be able to exploit this flaw remotely.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.