Veille CVE

Recherche « Red Hat Update Infrastructure 4 for Cloud Providers »

9 CVE

Critique 1 Élevée 2 Moyenne 6 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat Update Infrastructure 4 for Cloud Providers » ✕
  1. CVE-2026-103870 5.0 Moyenne

    Red Hat Satellite 6 · Red Hat Update Infrastructure 4 for Cloud Providers · Red Hat Update Infrastructure 5

    A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.

  2. CVE-2026-103868 6.5 Moyenne

    Red Hat Ansible Automation Platform 2 · Red Hat Satellite 6 · Red Hat Update Infrastructure 4 for Cloud Providers · Red Hat Update Infrastructure 5

    A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.

  3. CVE-2026-90959 8.1 Élevée

    Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat Ansible Automation Platform 2.6 · Red Hat Ansible Automation Platform 2.7 · Red Hat Ansible Automation Platform 2

    A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry.

  4. CVE-2026-84232 5.4 Moyenne

    Red Hat Ansible Automation Platform 2 · Red Hat Satellite 6 · Red Hat Update Infrastructure 4 for Cloud Providers · Red Hat Update Infrastructure 5

    A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment header when using local filesystem storage. An authenticated user or attacker with content upload permissions can upload a specially crafted HTML or SVG file containing JavaScript, which executes in the browser of any user who visits the file URL, resulting in stored cross-site scripting (XSS) in the context of the host application.

  5. CVE-2026-82327 5.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

  6. CVE-2026-12701 9.0 Critique

    Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat Satellite 6.16 for RHEL 8

    A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.

  7. CVE-2026-48863 7.5 Élevée

    OpenSUSE libsolv · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.

  8. CVE-2026-9149 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Hardened Images · Red Hat Enterprise Linux 7

    A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

  9. CVE-2026-9150 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Hardened Images · Red Hat Enterprise Linux 7

    A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.