huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
incorrect handling of CIDR in some configurations allows arbitrary source IP addresses within the network
CVE: CVE-2025-62820
Component: nebula
CVSS v3: 4.7/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
Release date: 2025-10-23T00:00:00+00:00

A flaw was found in Slack Nebula. An improper CIDR construction in the hostmap logic makes the inbound firewall overly permissive for nodes with certificates allowing subnets or multiple IPs. An attacker controlling such a node can send packets with arbitrary source IP addresses within the network. This allows the attacker to impersonate other nodes, disrupt traffic via TCP RST packets, or send arbitrary UDP packets.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
CVE: CVE-2025-38330
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)

KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets().
The code uses mock_coeff_template.length_bytes (4 bytes) for register value
allocations. But later, this length is set to 8 bytes which causes
test code failures.

As fix, just remove the lenght override, keeping the original value 4
for all operations.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
thunderbird: Potential user-assisted code execution in “Copy as cURL” command
CVE: CVE-2025-8030
Component: firefox
CWE: CWE-94
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-07-22T20:49:25.931000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
BinUtils: Denial of Service via crafted PE file
CVE: CVE-2025-66863
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-12-29T00:00:00+00:00

A flaw was found in BinUtils. Attackers can exploit this vulnerability by providing a specially crafted Portable Executable (PE) file. This can lead to a denial of service, making the affected application unavailable.

Statement: This vulnerability is rated Low for Red Hat products. The flaw in BinUtils allows for a denial of service when processing a specially crafted Portable Executable (PE) file. For a successful attack to take place the user needs to be tricked to process the maliciously crafted PE binary using the affected program. The consequences of a successful attack is also restricted to the single process instance reading the malicious file and does not have a system-wide effect, presenting a Low impact in the availability criteria.

Remediation:
To reduce the risk of exploitation, users should avoid processing Portable Executable (PE) files from untrusted or unverified sources with BinUtils tools. Limiting the exposure of BinUtils to untrusted input can help prevent denial of service attacks.
Spring Security BCryptPasswordEncoder does not enforce maximum password length
CVE: CVE-2025-22228
Component: spring-security-core
CWE: CWE-863
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-03-20T05:49:19.275000+00:00

A flaw was found in the spring-security-core password encoder. This vulnerability allows incorrect password matching via input manipulation.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat Product Security does not have a recommended mitigation at this time.
arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
CVE: CVE-2025-37929
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays

Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the
spectre_bhb_loop_affected() lists") added some additional CPUs to the
Spectre-BHB workaround, including some new arrays for designs that
require new 'k' values for the workaround to be effective.

Unfortunately, the new arrays omitted the sentinel entry and so
is_midr_in_range_list() will walk off the end when it doesn't find a
match. With UBSAN enabled, this leads to a crash during boot when
is_midr_in_range_list() is inlined (which was more common prior to
c8c2647e69be ("arm64: Make  _midr_in_range_list() an exported
function")):

 |  Internal error: aarch64 BRK: 00000000f2000001 [#1] PREEMPT SMP
 |  pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 |  pc : spectre_bhb_loop_affected+0x28/0x30
 |  lr : is_spectre_bhb_affected+0x170/0x190
 | [...]
 |  Call trace:
 |   spectre_bhb_loop_affected+0x28/0x30
 |   update_cpu_capabilities+0xc0/0x184
 |   init_cpu_features+0x188/0x1a4
 |   cpuinfo_store_boot_cpu+0x4c/0x60
 |   smp_prepare_boot_cpu+0x38/0x54
 |   start_kernel+0x8c/0x478
 |   __primary_switched+0xc8/0xd4
 |  Code: 6b09011f 54000061 52801080 d65f03c0 (d4200020)
 |  ---[ end trace 0000000000000000 ]---
 |  Kernel panic - not syncing: aarch64 BRK: Fatal exception

Add the missing sentinel entries.


Remediation:
.NET Security Feature Bypass Vulnerability
CVE: CVE-2025-55315
Component: dotnet
CWE: CWE-444
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Release date: 2025-10-15T12:58:31.281000+00:00

A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended forwarding of request data.

Statement: The Red Hat Product Security team has assessed this issue as Important. An authorized network attacker can exploit inconsistent HTTP request parsing in ASP.NET Core to bypass security controls (HTTP request smuggling), potentially exposing or enabling unauthorized actions on request data in affected .NET runtimes.

```

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. No fixes will be provided for this stream. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

```

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
udp_tunnel: use netdev_warn() instead of netdev_WARN()
CVE: CVE-2025-68191
Component: kernel
CWE: CWE-779
Severity: Important
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-16T00:00:00+00:00

An inappropriate warning severity was found in the UDP tunnel code in the Linux kernel. The code uses netdev_WARN() (which triggers WARN_ON with stack trace) for normal allocation failures in udp_tunnel_nic_register(). This can cause unnecessary system instability alerts for routine memory pressure situations.

Statement: This is a code quality improvement rather than a security fix. Using WARN for expected error conditions creates noise in logs and could trigger panic-on-warn configurations unnecessarily.

Remediation:
Kibana Stored Cross-Site Scripting (XSS)
CVE: CVE-2025-25017
Component: Kibana
CWE: CWE-79
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Release date: 2025-10-10T09:53:25.634000+00:00

A Cross-Site Scripting (XSS) vulnerability in Kibana’s Vega visualization engine. It results from improper input validation in Vega visualization specifications, allowing attackers to inject malicious JavaScript. Successful exploitation could lead to session hijacking, data theft, or privilege escalation within Kibana dashboards.

Statement: This vulnerability is rated Important rather than Moderate because it allows unauthenticated remote exploitation through user interaction, enabling attackers to execute arbitrary JavaScript within the Kibana interface and compromise the confidentiality and integrity of dashboard data. Unlike moderate XSS issues confined to low-impact contexts, this flaw occurs in the Vega visualization engine, which operates within privileged browser sessions connected to sensitive Elastic data. The cross-context nature (S:C) and high integrity impact (I:H) in the CVSS vector indicate that an attacker can potentially elevate privileges, steal session tokens, or alter visualization outputs, posing a significant risk to operational security and data trust within the Kibana environment.

Remediation:
Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.
scsi: qla1280: Fix kernel oops when debug level > 2
CVE: CVE-2025-21957
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla1280: Fix kernel oops when debug level > 2

A null dereference or oops exception will eventually occur when qla1280.c
driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2.  I
think its clear from the code that the intention here is sg_dma_len(s) not
length of sg_next(s) when printing the debug info.


Remediation:
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
CVE: CVE-2025-6491
Component: php
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-05T00:00:00+00:00

A vulnerability was found in PHP. If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.


Remediation:
Currently, no mitigation is currently available for this vulnerability.
s390/sclp: Add check for get_zeroed_page()
CVE: CVE-2025-37883
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/sclp: Add check for get_zeroed_page()

Add check for the return value of get_zeroed_page() in
sclp_console_init() to prevent null pointer dereference.
Furthermore, to solve the memory leak caused by the loop
allocation, add a free helper to do the free job.


Remediation:
misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()
CVE: CVE-2025-40117
Component: kernel
Severity: None
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()

Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case")
added NO_BAR (-1) to the pci_barno enum which, in practical terms,
changes the enum from an unsigned int to a signed int.  If the user
passes a negative number in pci_endpoint_test_ioctl() then it results in
an array underflow in pci_endpoint_test_bar().


Remediation:
NATS-Server Fails to Authorize Certain Jetstream Admin APIs
CVE: CVE-2025-30215
Component: nats-server
CWE: CWE-306
Severity: Critical
CVSS v3: 9.3/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Release date: 2025-04-15T23:25:43.143000+00:00

A flaw was found in NATS-SERVER. In affected versions of NATS-SERVER, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some JS API requests were missing access controls, allowing any user with JS management permissions to perform specific administrative actions on any JS asset in any account. At least one of the unprotected APIs allows data to be deleted. This issue does not restrict who can perform specific administrative tasks on someone else's JetStream assets. None of the affected APIs allow disclosing stream contents.

Statement: The Trusted Profile Analyzer guac container is not affected by this vulnerability as guac is used without NATS and NATS is not installed with the product.

Remediation:
vfio/pds: Fix missing detach_ioas op
CVE: CVE-2025-38625
Component: kernel
Severity: None
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vfio/pds: Fix missing detach_ioas op

When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci
driver, the following WARN_ON() trace is seen and probe fails:

WARNING: CPU: 0 PID: 5040 at drivers/vfio/vfio_main.c:317 __vfio_register_dev+0x130/0x140 [vfio]
<...>
pds_vfio_pci 0000:08:00.1: probe with driver pds_vfio_pci failed with error -22

This is because the driver's vfio_device_ops.detach_ioas isn't set.

Fix this by using the generic vfio_iommufd_physical_detach_ioas
function.


Remediation:
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
CVE: CVE-2025-39937
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer

Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from
device property") rfkill_find_type() gets called with the possibly
uninitialized "const char *type_name;" local variable.

On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752"
acpi_device, the rfkill->type is set based on the ACPI acpi_device_id:

        rfkill->type = (unsigned)id->driver_data;

and there is no "type" property so device_property_read_string() will fail
and leave type_name uninitialized, leading to a potential crash.

rfkill_find_type() does accept a NULL pointer, fix the potential crash
by initializing type_name to NULL.

Note likely sofar this has not been caught because:

1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device
2. The stack happened to contain NULL where type_name is stored


Remediation:
incorrect authorization for deletion of releases
CVE: CVE-2025-68938
Component: gitea
CWE: CWE-863
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2025-12-26T01:19:10.609000+00:00

A flaw was found in Gitea. An incorrect authorization allows an authenticated user with minimal privileges to delete project releases, causing a loss of availability of project assets and distribution history.

Statement: This issue will only cause the deletion of project assets and distribution history with no other security impact, such as memory corruption or arbitrary code execution. Additionally, exploitation requires an authenticated account with minimal privileges, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Mutation XSS in DOMPurify Due to Improper Template Literal Handling
CVE: CVE-2025-26791
Component: dompurify
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2025-02-14T00:00:00+00:00

A flaw was found in DOMPurify. This vulnerability allows attackers to execute mutation-based Cross-site scripting (mXSS) via an incorrect template literal regular expression.


Remediation:
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
For more about Red Hat Developer Hub, see References links
For Red Hat OpenShift AI 2.16.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 2.19.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
CVE: CVE-2025-2082
Component: Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability
Release date: 2025-04-30T19:58:23.045000+00:00

Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the VCSEC module. By manipulating the certificate response sent from the Tire Pressure Monitoring System (TPMS), an attacker can trigger an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the VCSEC module and send arbitrary messages to the vehicle CAN bus. Was ZDI-CAN-23800.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-5747
Component: WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability
Release date: 2025-06-06T15:28:28.531000+00:00

WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installatons of WOLFBOX Level 2 EV Charger devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of command frames received by the MCU. When parsing frames, the process does not properly detect the start of a frame, which can lead to misinterpretation of input. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26501.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-7280
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:58:28.920000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26214.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
CVE: CVE-2025-38275
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

The qmp_usb_iomap() helper function currently returns the raw result of
devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return
a NULL pointer and the caller only checks error pointers with IS_ERR(),
NULL could bypass the check and lead to an invalid dereference.

Fix the issue by checking if devm_ioremap() returns NULL. When it does,
qmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM),
ensuring safe and consistent error handling.


Remediation:
OpenShift Service Mesh Envoy HTTP Header Sanitization Bypass Leading to DoS and Unauthorized Access
CVE: CVE-2025-0752
Component: envoyproxy
CWE: CWE-444
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-01-21T00:00:00+00:00

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.

Statement: This IMPORTANT flaw in OpenShift Service Mesh 2.6.3 and 2.5.6 allows an attacker to bypass HTTP header sanitization in Envoy. This can lead to rate-limiter avoidance, access-control bypass, and resource exhaustion, potentially resulting in denial-of-service or unauthorized access within the service mesh environment. The vulnerability impacts deployments utilizing these specific versions of OpenShift Service Mesh.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.