Most recent entries from osv_rocky

RLSA-2026:71658 — Important: python-cryptography security update

Sat, 26 Sep 2026 12:12:16 +0000

Affected: Rocky Linux:10: python-cryptography

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building (CVE-2026-69249)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:73998 — Important: gvfs security update

Thu, 01 Oct 2026 12:08:49 +0000

Affected: Rocky Linux:10: gvfs

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer.

Security Fix(es):

* gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268)

* gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:74001 — Important: expat security update

Thu, 01 Oct 2026 12:08:49 +0000

Affected: Rocky Linux:10: expat

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)

* expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:73954 — Moderate: openssh security update

Thu, 01 Oct 2026 12:08:49 +0000

Affected: Rocky Linux:10: openssh

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

* openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay (CVE-2026-60001)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:73765 — Important: dogtag-pki security update

Thu, 01 Oct 2026 12:08:49 +0000

Affected: Rocky Linux:10: dogtag-pki

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder

Security Fix(es):

* pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)

* pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:73429 — Moderate: gawk security update

Wed, 30 Sep 2026 12:10:38 +0000

Affected: Rocky Linux:10: gawk

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.

Security Fix(es):

* gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)

* gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553)

* gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:73428 — Important: nodejs24 security, bug fix, and enhancement update

Thu, 01 Oct 2026 12:08:49 +0000

Affected: Rocky Linux:10: nodejs24

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Bug Fix(es) and Enhancement(s):

* nodejs24: Rebase to the latest Node.js 24 release [rhel-10] (JIRA:Rocky Linux-249187)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:73427 — Important: gdb security update

Wed, 30 Sep 2026 12:10:38 +0000

Affected: Rocky Linux:10: gdb

The GNU Debugger (GDB) allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and printing their data.

Security Fix(es):

* gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF (CVE-2026-13732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:73130 — Important: thunderbird security update

Wed, 30 Sep 2026 12:10:38 +0000

Affected: Rocky Linux:10: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365)

* firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874)

* firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121)

* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145)

* firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119)

* firefox: Use-after-free in the Audio/Video component (CVE-2026-84120)

* firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131)

* firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124)

* firefox: Use-after-free in the Audio/Video component (CVE-2026-84122)

* firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143)

* thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)

* thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641)

* thunderbird: One byte overflow read in mail parser (CVE-2026-84640)

* firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

* firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

* firefox: thunderbird: Use-after-free in the…

RLSA-2026:72624 — Important: kernel security, bug fix, and enhancement update

Wed, 30 Sep 2026 12:10:38 +0000

Affected: Rocky Linux:10: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

* kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

* kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

* kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

* kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)

* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

* kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

* kernel: perf: Reject exited events as group leaders (CVE-2026-74753)

* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

* kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

Bug Fix(es) and Enhancement(s):

* KVM: s390: Limit adapter indicator access to mapped page [rhel-10.2.z] (JIRA:Rocky Linux-188661)

* crypto: xxhash64 should not be fips approved [rhel-10.2.z] (JIRA:Rocky Linux-254943)

* kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:Rocky Linux-260402)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to…