# ndaal SBOM Auditor — analysis of cyclonedx.json (SBOM #1239)

## SBOM metadata

| Field | Value |
| --- | --- |
| Name | cyclonedx.json |
| Format | cyclonedx-json |
| Spec version | 1.6 |
| Components | 192 |
| Source | upload |
| Size (bytes) | 412682 |
| SHA-256 | `0b7256c1504e598e3be00fc48ebba0a19e2f94d73b9357ca7193838bdda21c5c` |
| Ingested | 2026-09-01T17:01:35Z |

## Analyzer summary

| Tool | Version | Status | Findings |
| --- | --- | --- | --- |
| syft | 1.51.0 | ok | 0 |
| grype | 0.117.0 | ok | 223 |
| trivy | 0.74.0 | ok | 0 |
| osv-scanner | 2.5.1 | ok | 0 |
| bomber | 0.5.1 | ok | 0 |
| bomdrift | bomdrift 0.9.9 | ok | 1 |
| inspektr_cli | inspektr 0.1.9 | ok | 0 |
| shieldbom | shieldbom 0.3.0 | fail | 0 |
| provenant | provenant-cli 1.0.8 | ok | 0 |

## Findings from grype

| Severity | Vulnerability | Package | Fixed in | Description |
| --- | --- | --- | --- | --- |
| high | ELSA-2024-10244 (CVE-2024-10963) | pam@1.5.1-19.0.2.el9 | 0:1.5.1-22.0.1.el9_5 | [1.5.1-22.0.1] - pam_access: clean up the remote host matching code [Orabug: 36771903] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]  [1.5.1-22] - pam_access: rework resolving of tokens as hostname.   Resolves: CVE-2024-10963 and RHEL-66245  [1.5.1-21] - pam_unix: always run the helper to obtain shadow password file entries.   CVE-2024-10041. Resolves: RHEL-62880 |
| high | ELSA-2024-9474 (CVE-2024-3596) | krb5-libs@1.21.1-2.0.1.el9_4 | 0:1.21.1-4.0.1.el9_5 | [1.21.1-4.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767]  [1.21.1-4] - libkrad: implement support for Message-Authenticator (CVE-2024-3596)   Resolves: RHEL-55423 - Fix various issues detected by static analysis   Resolves: RHEL-58216 - Remove RSA protocol for PKINIT   Resolves: RHEL-15323 |
| high | ELSA-2025-10136 (CVE-2024-12718) | python3@3.9.18-3.el9_4.5 | 0:3.9.21-2.el9_6.1 | [3.9.21-2.1] - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 Resolves: RHEL-98053, RHEL-98025, RHEL-98243, RHEL-98195, RHEL-98219 |
| high | ELSA-2025-10136 (CVE-2024-12718) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.21-2.el9_6.1 | [3.9.21-2.1] - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 Resolves: RHEL-98053, RHEL-98025, RHEL-98243, RHEL-98195, RHEL-98219 |
| high | ELSA-2025-10699 (CVE-2025-6021) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-10.el9_6 | [2.9.13-10] - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) |
| high | ELSA-2025-11992 (CVE-2025-6965) | sqlite-libs@3.34.1-7.el9_3 | 0:3.34.1-8.el9_6 | [3.34.1-8] - Fixes CVE-2025-6965 |
| high | ELSA-2025-12447 (CVE-2025-7425) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-11.el9_6 | [2.9.13-11] - Fix CVE-2025-7425 (RHEL-102806) |
| high | ELSA-2025-1330 (CVE-2024-12797) | openssl@1:3.0.7-28.0.1.el9_4 | 1:3.2.2-6.0.1.el9_5.1 | [3.2.2-6.0.1.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.2.2-6.1] - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)                                                                                                                                                   Resolves: RHEL-76755 |
| high | ELSA-2025-1330 (CVE-2024-12797) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 1:3.2.2-6.0.1.el9_5.1 | [3.2.2-6.0.1.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.2.2-6.1] - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)                                                                                                                                                   Resolves: RHEL-76755 |
| high | ELSA-2025-1350 (CVE-2022-49043) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-6.el9_5.1 | [2.9.13-6.1] - Fix CVE-2022-49043 (RHEL-76298) |
| high | ELSA-2025-14130 (CVE-2025-5914) | libarchive@3.5.3-4.el9 | 0:3.5.3-6.el9_6 | [3.5.3-6] - Resolves: CVE-2025-5914 |
| high | ELSA-2025-15099 (CVE-2025-6020) | pam@1.5.1-19.0.2.el9 | 0:1.5.1-26.0.1.el9_6 | [1.5.1-26.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]  [1.5.1-26] - pam_namespace: fix potential privilege escalation.   Resolves: CVE-2025-6020 and RHEL-96729 |
| high | ELSA-2025-20344 (CVE-2025-4598) | systemd@252-32.0.2.el9_4.7 | 0:252-51.0.2.el9 | [252-51.0.2] - coredump: use %d in kernel core pattern - CVE-2025-4598 |
| high | ELSA-2025-20344 (CVE-2025-4598) | systemd-libs@252-32.0.2.el9_4.7 | 0:252-51.0.2.el9 | [252-51.0.2] - coredump: use %d in kernel core pattern - CVE-2025-4598 |
| high | ELSA-2025-20344 (CVE-2025-4598) | systemd-pam@252-32.0.2.el9_4.7 | 0:252-51.0.2.el9 | [252-51.0.2] - coredump: use %d in kernel core pattern - CVE-2025-4598 |
| high | ELSA-2025-20344 (CVE-2025-4598) | systemd-rpm-macros@252-32.0.2.el9_4.7 | 0:252-51.0.2.el9 | [252-51.0.2] - coredump: use %d in kernel core pattern - CVE-2025-4598 |
| high | ELSA-2025-20936 (CVE-2025-6965) | sqlite-libs@3.34.1-7.el9_3 | 0:3.34.1-9.el9_7 | [3.34.1-9] - Fixes CVE-2025-6965 |
| high | ELSA-2025-22175 (CVE-2025-59375) | expat@2.5.0-2.el9_4.1 | 0:2.5.0-5.el9_7.1 | [2.5.0-5.1] - Fix CVE-2025-59375 - Resolves: RHEL-114644 |
| high | ELSA-2025-2679 (CVE-2025-24928) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-6.el9_5.2 | [2.9.13-6.2] - Fix CVE-2024-56171 (RHEL-80128) - Fix CVE-2025-24928 (RHEL-80143) |
| high | ELSA-2025-9526 (CVE-2025-6020) | pam@1.5.1-19.0.2.el9 | 0:1.5.1-25.0.1.el9_6 | [1.5.1-25.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]  [1.5.1-25] - pam_namespace: fix potential privilege escalation.   Resolves: CVE-2025-6020 and RHEL-96729 |
| high | ELSA-2026-0719 (CVE-2025-68973) | gnupg2@2.3.3-4.el9 | 0:2.3.3-5.el9_7 | [2.3.3-5] - Fix CVE-2025-68973 (gpg.fail/memcpy) |
| high | ELSA-2026-10949 (CVE-2026-4786) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7.3 | [3.9.25-3.0.1.el9_7.3] - Remove upstream URL reference  [3.9.25-3.3] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-168157, RHEL-167915  [3.9.25-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158052  [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893 |
| high | ELSA-2026-10949 (CVE-2026-4786) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7.3 | [3.9.25-3.0.1.el9_7.3] - Remove upstream URL reference  [3.9.25-3.3] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-168157, RHEL-167915  [3.9.25-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158052  [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893 |
| high | ELSA-2026-11510 (CVE-2026-34982) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-23.0.1.el9_7.3 | [8.2.2637-23.0.1.el9_7.3] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-23.3] - Resolves: RHEL-164965 vim: arbitrary command execution via modeline sandbox bypass  [2:8.2.2637-23.2] - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155422 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-159629 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function  [2:8.2.2637-23.1] - RHEL-147940 CVE-2026-25749 vim: Heap Overflow in Vim |
| high | ELSA-2026-12441 (CVE-2026-4878) | libcap@2.48-9.el9_2 | 0:2.48-10.el9_7.1 | [2.48-10.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878)   Resolves: RHEL-169311 |
| high | ELSA-2026-13381 (CVE-2026-35385) | openssh@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-49.0.1.el9_7 | [8.7p1-49.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-49] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol   when not in preserving file mode   Resolves: RHEL-164752 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode   multiplexing sessions   Resolves: RHEL-166249 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms   and HostbasedAcceptedAlgorithms with regard to ECDSA keys   Resolves: RHEL-166233 - CVE-2026-35414: Fix mishandling of authorized_keys principals option   Resolves: RHEL-166201 - CVE-2026-35386: Add validation rules to usernames and hostnames   set for ProxyJump/-J on the commandline   Resolves: RHEL-166217 |
| high | ELSA-2026-13381 (CVE-2026-35385) | openssh-clients@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-49.0.1.el9_7 | [8.7p1-49.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-49] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol   when not in preserving file mode   Resolves: RHEL-164752 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode   multiplexing sessions   Resolves: RHEL-166249 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms   and HostbasedAcceptedAlgorithms with regard to ECDSA keys   Resolves: RHEL-166233 - CVE-2026-35414: Fix mishandling of authorized_keys principals option   Resolves: RHEL-166201 - CVE-2026-35386: Add validation rules to usernames and hostnames   set for ProxyJump/-J on the commandline   Resolves: RHEL-166217 |
| high | ELSA-2026-13381 (CVE-2026-35385) | openssh-server@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-49.0.1.el9_7 | [8.7p1-49.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-49] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol   when not in preserving file mode   Resolves: RHEL-164752 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode   multiplexing sessions   Resolves: RHEL-166249 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms   and HostbasedAcceptedAlgorithms with regard to ECDSA keys   Resolves: RHEL-166233 - CVE-2026-35414: Fix mishandling of authorized_keys principals option   Resolves: RHEL-166201 - CVE-2026-35386: Add validation rules to usernames and hostnames   set for ProxyJump/-J on the commandline   Resolves: RHEL-166217 |
| high | ELSA-2026-1473 (CVE-2025-11187) | openssl@1:3.0.7-28.0.1.el9_4 | 1:3.5.1-7.0.1.el9_7 | [3.5.1-7.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-7] - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469   CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420   CVE-2025-69421 CVE-2026-22795 CVE-2026-22796   Resolves: RHEL-142068   Resolves: RHEL-142002   Resolves: RHEL-142055   Resolves: RHEL-142051   Resolves: RHEL-142047   Resolves: RHEL-142043   Resolves: RHEL-142039   Resolves: RHEL-142035   Resolves: RHEL-142031   Resolves: RHEL-142011   Resolves: RHEL-142027   Resolves: RHEL-142023  [1:3.5.1-6] - Fix AES/GCM ppc64le encrypt/decrypt   Resolves: RHEL-139131 |
| high | ELSA-2026-1473 (CVE-2025-11187) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 1:3.5.1-7.0.1.el9_7 | [3.5.1-7.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-7] - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469   CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420   CVE-2025-69421 CVE-2026-22795 CVE-2026-22796   Resolves: RHEL-142068   Resolves: RHEL-142002   Resolves: RHEL-142055   Resolves: RHEL-142051   Resolves: RHEL-142047   Resolves: RHEL-142043   Resolves: RHEL-142039   Resolves: RHEL-142035   Resolves: RHEL-142031   Resolves: RHEL-142011   Resolves: RHEL-142027   Resolves: RHEL-142023  [1:3.5.1-6] - Fix AES/GCM ppc64le encrypt/decrypt   Resolves: RHEL-139131 |
| high | ELSA-2026-19216 (CVE-2026-4519) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8 | [3.9.25-7.0.1] - Remove upstream URL reference  [3.9.25-7] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161  [3.9.25-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158117  [3.9.25-5] - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897  [3.9.25-4] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 |
| high | ELSA-2026-19216 (CVE-2026-4519) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8 | [3.9.25-7.0.1] - Remove upstream URL reference  [3.9.25-7] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161  [3.9.25-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158117  [3.9.25-5] - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897  [3.9.25-4] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 |
| high | ELSA-2026-19219 (CVE-2026-35385) | openssh@8.7p1-38.0.2.el9_4.4 | 0:9.9p1-7.0.2.el9_8 | [9.9p1-7.0.2] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076]  [9.9p1-7.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [9.9p1-7 + 0.10.4-9] - Version bump  [9.9p1-5 + 0.10.4-8] - CVE-2026-3497: Fix information disclosure or denial of service due   to uninitialized variables in gssapi-keyex   Resolves: RHEL-155825 - Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page   Resolves: RHEL-122302  [9.9p1-4] - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode   Resolves: RHEL-151580  [9.9p1-3] - Enable support for DSA keys   Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters   Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters   Resolves: RHEL-133960  [9.9p1-2] - Fix implicit destination path selection when source path ends with '..'   Resolves: RHEL-119515 - Canonicalize username when matching a user   Resolves: RHEL-118372  [9.9p1-1] - Rebase to version 9.9   Resolves: RHEL-108912 |
| high | ELSA-2026-19219 (CVE-2026-35385) | openssh-clients@8.7p1-38.0.2.el9_4.4 | 0:9.9p1-7.0.2.el9_8 | [9.9p1-7.0.2] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076]  [9.9p1-7.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [9.9p1-7 + 0.10.4-9] - Version bump  [9.9p1-5 + 0.10.4-8] - CVE-2026-3497: Fix information disclosure or denial of service due   to uninitialized variables in gssapi-keyex   Resolves: RHEL-155825 - Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page   Resolves: RHEL-122302  [9.9p1-4] - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode   Resolves: RHEL-151580  [9.9p1-3] - Enable support for DSA keys   Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters   Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters   Resolves: RHEL-133960  [9.9p1-2] - Fix implicit destination path selection when source path ends with '..'   Resolves: RHEL-119515 - Canonicalize username when matching a user   Resolves: RHEL-118372  [9.9p1-1] - Rebase to version 9.9   Resolves: RHEL-108912 |
| high | ELSA-2026-19219 (CVE-2026-35385) | openssh-server@8.7p1-38.0.2.el9_4.4 | 0:9.9p1-7.0.2.el9_8 | [9.9p1-7.0.2] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076]  [9.9p1-7.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [9.9p1-7 + 0.10.4-9] - Version bump  [9.9p1-5 + 0.10.4-8] - CVE-2026-3497: Fix information disclosure or denial of service due   to uninitialized variables in gssapi-keyex   Resolves: RHEL-155825 - Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page   Resolves: RHEL-122302  [9.9p1-4] - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode   Resolves: RHEL-151580  [9.9p1-3] - Enable support for DSA keys   Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters   Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters   Resolves: RHEL-133960  [9.9p1-2] - Fix implicit destination path selection when source path ends with '..'   Resolves: RHEL-119515 - Canonicalize username when matching a user   Resolves: RHEL-118372  [9.9p1-1] - Rebase to version 9.9   Resolves: RHEL-108912 |
| high | ELSA-2026-19224 (CVE-2026-34982) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-26.0.1.el9_8.4 | [2:8.2.2637-26.0.1.el9_8.4] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-26.4] - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass  [2:8.2.2637-26.3] - Related: RHEL-159630 rebuild to build with exception target  [2:8.2.2637-26.2] - remove -O0 from flags  [2:8.2.2637-26.1] - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function  [2:8.2.2637-26] - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file  [2:8.2.2637-25] - RHEL-147941 CVE-2026-25749 vim: Heap Overflow in Vim  [2:8.2.2637-24] - RHEL-143726 sudo not able to spawn 'vi' command when NOEXEC is used to prevent escaping to shell |
| high | ELSA-2026-19346 (CVE-2026-4878) | libcap@2.48-9.el9_2 | 0:2.48-10.el9_8.1 | [2.48-10.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878)   Resolves: RHEL-169312 |
| high | ELSA-2026-19357 (CVE-2026-40355) | krb5-libs@1.21.1-2.0.1.el9_4 | 0:1.21.1-10.0.1.el9_8 | [1.21.1-10.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767]  [1.21.1-10] - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)   Resolves: RHEL-171590 RHEL-171596 |
| high | ELSA-2026-2042 (CVE-2025-6176) | libbrotli@1.0.9-6.el9 | 0:1.0.9-9.el9_7 | [1.0.9-9] - Resolves: RHEL-133995   Rebuild for CVE-2025-6176 Brotli decompression bomb DoS in scrapy  [1.0.9-8] - Resolves: RHEL-133995   CVE-2025-6176 Brotli decompression bomb DoS in scrapy |
| high | ELSA-2026-20612 (CVE-2026-33845) | gnutls@3.8.3-4.el9_4 | 0:3.8.10-4.el9_8 | [3.8.10-4] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass) - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free) - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread) - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite) - Fix CVE-2026-3832 (OCSP, Low, revocation bypass) - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel) - Fix upstream security issue #1808 (PSK rehandshake) - Fix upstream security issue #1810 (EKU OID prefix match) - Fix upstream security issue #1813 (pkcs11-provider persistent keys) - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import) - Fix upstream security issue #1819 (PKCS#11 trust removal error path) - Fix upstream security issue #1822 (SCT extension parser OOB read) - Fix upstream security issue #1841 (key zeroization in hybrid kex) - Fix upstream security issue #1823 (malformed certtool template) - Fix upstream security issue #1817 (session parameter loading robustness) - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving) - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in |
| high | ELSA-2026-23230 (CVE-2026-45186) | expat@2.5.0-2.el9_4.1 | 0:2.5.0-6.el9_8.1 | [2.5.0-6.1] - Fix CVE-2026-45186 - Resolves: RHEL-177988 |
| high | ELSA-2026-25239 (CVE-2026-34180) | openssl@1:3.0.7-28.0.1.el9_4 | 1:3.5.5-4.0.1.el9_8 | [3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177]  [3.5.5.openela.0.1] - Add OpenELA specific changes  [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves:             RHEL-179274 Resolves:             RHEL-179287 Resolves:             RHEL-179539 Resolves:             RHEL-179544 Resolves:             RHEL-179547 Resolves:             RHEL-179552 Resolves:             RHEL-179556 Resolves:             RHEL-179633 Resolves:             RHEL-179661 Resolves:             RHEL-179678 Resolves:             RHEL-179684 Resolves:             RHEL-179688 Resolves:             RHEL-179691 Resolves:             RHEL-179696 Resolves:             RHEL-179699  [1:3.5.5-3] - Fix CVE-2026-28390   Resolves: RHEL-165870 |
| high | ELSA-2026-25239 (CVE-2026-34180) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 1:3.5.5-4.0.1.el9_8 | [3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177]  [3.5.5.openela.0.1] - Add OpenELA specific changes  [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves:             RHEL-179274 Resolves:             RHEL-179287 Resolves:             RHEL-179539 Resolves:             RHEL-179544 Resolves:             RHEL-179547 Resolves:             RHEL-179552 Resolves:             RHEL-179556 Resolves:             RHEL-179633 Resolves:             RHEL-179661 Resolves:             RHEL-179678 Resolves:             RHEL-179684 Resolves:             RHEL-179688 Resolves:             RHEL-179691 Resolves:             RHEL-179696 Resolves:             RHEL-179699  [1:3.5.5-3] - Fix CVE-2026-28390   Resolves: RHEL-165870 |
| high | ELSA-2026-38511 (CVE-2026-46483) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-26.0.1.el9_8.10 | [8.2.2637-26.0.1.el9_8.10] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-26.10] - RHEL-186659 CVE-2026-47162 vim: code injection via   NetrwBookHistSave()  [2:8.2.2637-26.9] - RHEL-186646 CVE-2026-52858 vim: possible code execution with   python3complete  [2:8.2.2637-26.8] - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin  [2:8.2.2637-26.7] - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin  [2:8.2.2637-26.6] - CVE-2026-41411 vim: Command injection via backticks in tag files  [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite   via path traversal bypass  [2:8.2.2637-26.4] - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass  [2:8.2.2637-26.3] - Related: RHEL-159630 rebuild to build with exception target  [2:8.2.2637-26.2] - remove -O0 from flags |
| high | ELSA-2026-39798 (CVE-2026-15308) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8.2 | [3.9.25-7.0.1.el9_8.2] - Remove upstream URL reference  [3.9.25-7.2] - Security fix for CVE-2026-15308 Resolves: RHEL-193786  [3.9.25-7.1] - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 |
| high | ELSA-2026-39798 (CVE-2026-15308) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8.2 | [3.9.25-7.0.1.el9_8.2] - Remove upstream URL reference  [3.9.25-7.2] - Security fix for CVE-2026-15308 Resolves: RHEL-193786  [3.9.25-7.1] - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 |
| high | ELSA-2026-42089 (CVE-2026-58016) | glib2@2.68.4-14.el9_4.1 | 0:2.68.4-19.el9_8.2 | [2.68.4-19.2] - Fix CVE-2026-58016: broken node element nesting validation in   D-Bus introspection XML parsing - Resolves: RHEL-190632 |
| high | ELSA-2026-42736 (CVE-2026-54369) | acl@2.3.1-4.el9 | 0:2.4.0-1.el9_8 | [2.4.0-1] - rebase to 2.4.0 to fix the following CVEs:   - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111)   - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216) |
| high | ELSA-2026-42736 (CVE-2026-54369) | libacl@2.3.1-4.el9 | 0:2.4.0-1.el9_8 | [2.4.0-1] - rebase to 2.4.0 to fix the following CVEs:   - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111)   - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216) |
| high | ELSA-2026-47756 (CVE-2026-55653) | openssh@8.7p1-38.0.2.el9_4.4 | 0:9.9p1-9.0.1.el9_8 | [9.9p1-9.0.1] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [9.9p1-9] - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed   in unintended parent directories when scp performs remote-to-remote copy   via the local host   Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange   Resolves: RHEL-193024  [9.9p1-8] - CVE-2026-55653: Fix double free in openssh DH-GEX client path during   FIPS known-group validation that leads to client-side denial of service   Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator   cleanup due to missing NULL terminator   Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket   pre-binding   Resolves: RHEL-185854 |
| high | ELSA-2026-47756 (CVE-2026-55653) | openssh-clients@8.7p1-38.0.2.el9_4.4 | 0:9.9p1-9.0.1.el9_8 | [9.9p1-9.0.1] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [9.9p1-9] - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed   in unintended parent directories when scp performs remote-to-remote copy   via the local host   Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange   Resolves: RHEL-193024  [9.9p1-8] - CVE-2026-55653: Fix double free in openssh DH-GEX client path during   FIPS known-group validation that leads to client-side denial of service   Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator   cleanup due to missing NULL terminator   Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket   pre-binding   Resolves: RHEL-185854 |
| high | ELSA-2026-47756 (CVE-2026-55653) | openssh-server@8.7p1-38.0.2.el9_4.4 | 0:9.9p1-9.0.1.el9_8 | [9.9p1-9.0.1] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [9.9p1-9] - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed   in unintended parent directories when scp performs remote-to-remote copy   via the local host   Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange   Resolves: RHEL-193024  [9.9p1-8] - CVE-2026-55653: Fix double free in openssh DH-GEX client path during   FIPS known-group validation that leads to client-side denial of service   Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator   cleanup due to missing NULL terminator   Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket   pre-binding   Resolves: RHEL-185854 |
| high | ELSA-2026-47982 (CVE-2026-55693) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-26.0.1.el9_8.13 | [8.2.2637-26.0.1.el9_8.13] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-26.13] - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution   in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in   PHP omni-completion  [2:8.2.2637-26.12] - RHEL-191367 CVE-2026-57455 vim: Out-of-bounds write with soundfold() - RHEL-192113 CVE-2026-57456 vim: possible code execution with   python complete via crafted docstrings  [2:8.2.2637-26.11] - RHEL-194062 CVE-2026-55693 vim: out-of-bounds write in   tree_count_words() and sug_filltree()  [2:8.2.2637-26.10] - RHEL-186659 CVE-2026-47162 vim: code injection via   NetrwBookHistSave()  [2:8.2.2637-26.9] - RHEL-186646 CVE-2026-52858 vim: possible code execution with   python3complete  [2:8.2.2637-26.8] - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin  [2:8.2.2637-26.7] - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin  [2:8.2.2637-26.6] - CVE-2026-41411 vim: Command injection via backticks in tag files  [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite   via path traversal bypass |
| high | ELSA-2026-50075 (CVE-2025-11187) | openssl@1:3.0.7-28.0.1.el9_4 | 10:3.5.1-7.0.1.el9_7_fips | [3.5.1-7.0.1_fips] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276]  [3.5.1-7.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-7] - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469   CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420   CVE-2025-69421 CVE-2026-22795 CVE-2026-22796   Resolves: RHEL-142068   Resolves: RHEL-142002   Resolves: RHEL-142055   Resolves: RHEL-142051   Resolves: RHEL-142047   Resolves: RHEL-142043   Resolves: RHEL-142039   Resolves: RHEL-142035   Resolves: RHEL-142031   Resolves: RHEL-142011   Resolves: RHEL-142027   Resolves: RHEL-142023  [1:3.5.1-6] - Fix AES/GCM ppc64le encrypt/decrypt   Resolves: RHEL-139131 |
| high | ELSA-2026-50075 (CVE-2025-11187) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 10:3.5.1-7.0.1.el9_7_fips | [3.5.1-7.0.1_fips] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276]  [3.5.1-7.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-7] - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469   CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420   CVE-2025-69421 CVE-2026-22795 CVE-2026-22796   Resolves: RHEL-142068   Resolves: RHEL-142002   Resolves: RHEL-142055   Resolves: RHEL-142051   Resolves: RHEL-142047   Resolves: RHEL-142043   Resolves: RHEL-142039   Resolves: RHEL-142035   Resolves: RHEL-142031   Resolves: RHEL-142011   Resolves: RHEL-142027   Resolves: RHEL-142023  [1:3.5.1-6] - Fix AES/GCM ppc64le encrypt/decrypt   Resolves: RHEL-139131 |
| high | ELSA-2026-50346 (CVE-2026-33845) | gnutls@3.8.3-4.el9_4 | 10:3.8.10-4.el9_8_fips | [3.8.10-4_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409]  [3.8.10-4] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass) - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass) - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse) - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free) - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread) - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite) - Fix CVE-2026-3832 (OCSP, Low, revocation bypass) - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel) - Fix upstream security issue #1808 (PSK rehandshake) - Fix upstream security issue #1810 (EKU OID prefix match) - Fix upstream security issue #1813 (pkcs11-provider persistent keys) - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import) - Fix upstream security issue #1819 (PKCS#11 trust removal error path) - Fix upstream security issue #1822 (SCT extension parser OOB read) - Fix upstream security issue #1841 (key zeroization in hybrid kex) - Fix upstream security issue #1823 (malformed certtool template) - Fix upstream security issue #1817 (session parameter loading robustness) - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving) - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in  [3.8.10-3] - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831)  [3.8.10-2] - Reinstate and update the prematurely dropped rekeying patch  [3.8.10-1] - Rebase to 3.8.10 - Revert defaulting to PBMAC1 in FIPS mode - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification |
| high | ELSA-2026-5080 (CVE-2026-4111) | libarchive@3.5.3-4.el9 | 0:3.5.3-7.el9_7 | [3.5.3-7] - Resolves: CVE-2026-4111 |
| high | ELSA-2026-54268 (CVE-2026-11940) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8.3 | [3.9.25-7.0.1.el9_8.3] - Remove upstream URL reference  [3.9.25-7.3] - Security fix for CVE-2026-11940 Resolves: RHEL-227228  [3.9.25-7.2] - Security fix for CVE-2026-15308 Resolves: RHEL-193786  [3.9.25-7.1] - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 |
| high | ELSA-2026-54268 (CVE-2026-11940) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8.3 | [3.9.25-7.0.1.el9_8.3] - Remove upstream URL reference  [3.9.25-7.3] - Security fix for CVE-2026-11940 Resolves: RHEL-227228  [3.9.25-7.2] - Security fix for CVE-2026-15308 Resolves: RHEL-193786  [3.9.25-7.1] - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207 |
| high | ELSA-2026-55439 (CVE-2026-1965) | curl@7.76.1-29.el9_4.1 | 0:7.76.1-40.el9_8.5 | [7.76.1-40.el9_8.5] - fix missing %patch macros for Patch46 and Patch47  [7.76.1-40.el9_8.4] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind)  [7.76.1-40.3] - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race)  [7.76.1-40.1] - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) |
| high | ELSA-2026-55439 (CVE-2026-1965) | libcurl@7.76.1-29.el9_4.1 | 0:7.76.1-40.el9_8.5 | [7.76.1-40.el9_8.5] - fix missing %patch macros for Patch46 and Patch47  [7.76.1-40.el9_8.4] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind)  [7.76.1-40.3] - tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race)  [7.76.1-40.1] - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) |
| high | ELSA-2026-58936 (CVE-2026-11822) | sqlite-libs@3.34.1-7.el9_3 | 0:3.34.1-11.el9_8 | [3.34.1-11] - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218247 - Resolves: RHEL-218282 |
| high | ELSA-2026-6462 (CVE-2026-3497) | openssh@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-48.0.1.el9_7 | [8.7p1-48.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-48] - CVE-2026-3497: Fix information disclosure or denial of service due   to uninitialized variables in gssapi-keyex   Resolves: RHEL-155823 |
| high | ELSA-2026-6462 (CVE-2026-3497) | openssh-clients@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-48.0.1.el9_7 | [8.7p1-48.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-48] - CVE-2026-3497: Fix information disclosure or denial of service due   to uninitialized variables in gssapi-keyex   Resolves: RHEL-155823 |
| high | ELSA-2026-6462 (CVE-2026-3497) | openssh-server@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-48.0.1.el9_7 | [8.7p1-48.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-48] - CVE-2026-3497: Fix information disclosure or denial of service due   to uninitialized variables in gssapi-keyex   Resolves: RHEL-155823 |
| high | ELSA-2026-6766 (CVE-2026-4519) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7.2 | [3.9.25-3.0.1.el9_7.2] - Remove upstream URL reference  [3.9.25-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158052  [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893 |
| high | ELSA-2026-6766 (CVE-2026-4519) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7.2 | [3.9.25-3.0.1.el9_7.2] - Remove upstream URL reference  [3.9.25-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158052  [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893 |
| high | ELSA-2026-7668 (CVE-2026-27135) | libnghttp2@1.43.0-5.el9_4.3 | 0:1.43.0-6.el9_7.1 | [1.43.0-6.1] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135) |
| high | ELSA-2026-8259 (CVE-2026-28417) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-23.0.1.el9_7.2 | [8.2.2637-23.0.1.el9_7.2] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-23.2] - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155422 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file - RHEL-159629 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function  [2:8.2.2637-23.1] - RHEL-147940 CVE-2026-25749 vim: Heap Overflow in Vim |
| high | ELSA-2026-8510 (CVE-2026-4424) | libarchive@3.5.3-4.el9 | 0:3.5.3-9.el9_7 | [3.5.3-9] - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121  [3.5.3-8] - Release bump |
| medium | ELSA-2024-10983 (CVE-2024-11168) | python3@3.9.18-3.el9_4.5 | 0:3.9.21-1.el9_5 | [3.9.21-1] - Update to 3.9.21 - Security fix for CVE-2024-11168 and CVE-2024-9287 Resolves: RHEL-64888 Resolves: RHEL-67259 |
| medium | ELSA-2024-10983 (CVE-2024-11168) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.21-1.el9_5 | [3.9.21-1] - Update to 3.9.21 - Security fix for CVE-2024-11168 and CVE-2024-9287 Resolves: RHEL-64888 Resolves: RHEL-67259 |
| medium | ELSA-2024-11250 (CVE-2024-10041) | pam@1.5.1-19.0.2.el9 | 0:1.5.1-21.0.1.el9_5 | [1.5.1-21.0.1] - pam_access: clean up the remote host matching code [Orabug: 36771903] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534]  [1.5.1-21] - pam_unix: always run the helper to obtain shadow password file entries.   CVE-2024-10041. Resolves: RHEL-62880  [1.5.1-20] - libpam: support long lines in service files. Resolves: RHEL-40705  [1.5.1-19] - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS   situations. CVE-2024-22365. Resolves: RHEL-21244  [1.5.1-18] - libpam: use getlogin() from libc and not utmp. Resolves: RHEL-16727 - pam_access: handle hostnames in access.conf. Resolves: RHEL-22300  [1.5.1-17] - pam_faillock: create tallydir before creating tallyfile. Resolves: RHEL-20943  [1.5.1-16] - libpam: use close_range() to close file descriptors. Resolves: RHEL-5099 - fix formatting of audit messages. Resolves: RHEL-5100  [1.5.1-15] - pam_misc: make length of misc_conv() configurable and set to 4096. Resolves: #2215007 |
| medium | ELSA-2024-12336 (CVE-2024-0553) | gnutls@3.8.3-4.el9_4 | 10:3.7.6-23.el9_3.4_fips | [3.7.6-23.4_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409] - Verify salt length and iteration count for PBKDF [Orabug: 35925409]  [3.7.6-23.4] - Fix timing side-channel in deterministic ECDSA (RHEL-28958) - Fix potential crash during chain building/verification (RHEL-28953)  [3.7.6-23.3] - x509: detect loop in certificate chain (RHEL-21759) - fips: Zeroize temporary values in integrity check (RHEL-21870)  [3.7.6-23.2] - auth/rsa_psk: minimize branching after decryption  [3.7.6-23.1] - auth/rsa_psk: side-step potential side-channel (RHEL-16755)  [3.7.6-23] - Mark SHA-1 signature verification non-approved in FIPS (#2102751)  [3.7.6-22] - Skip KTLS test on old kernel if host and target arches are different |
| medium | ELSA-2024-12364 (CVE-2024-28834) | gnutls@3.8.3-4.el9_4 | 10:3.8.3-4.el9_4_fips | [3.8.3-4_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409]  [3.8.3-4] - Bump release to ensure el9 package is greater than el9_* packages  [3.8.3-3] - Bump release to ensure el9 package is greater than el9_* packages  [3.8.3-2] - Fix timing side-channel in deterministic ECDSA (RHEL-28959) - Fix potential crash during chain building/verification (RHEL-28954)  [3.8.3-1] - Update to gnutls 3.8.3 (RHEL-14891)  [3.8.2-3] - Skip KTLS test exercising ChaCha20-Poly1305 in TLS 1.3 as well (RHEL-18498)  [3.8.2-2] - Bump nettle dependency to 3.9.1 - Skip KTLS test exercising ChaCha20-Poly1305 in TLS 1.2 (RHEL-18498)  [3.8.2-1] - Update to gnutls 3.8.2 (RHEL-14891) |
| medium | ELSA-2024-12675 (CVE-2024-6119) | openssl@1:3.0.7-28.0.1.el9_4 | 10:3.0.7-28.0.1.el9_4_fips | [3.0.7-28.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name and remove upstream references from   fips_module_indicators manpage [Orabug: 35824276]  [3.0.7-28.0.1] - Drop OpenELA branding, apply Oracle branding patches - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.0.7-28] - Patch for CVE-2024-6119   Resolves: RHEL-55340 |
| medium | ELSA-2024-12675 (CVE-2024-6119) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 10:3.0.7-28.0.1.el9_4_fips | [3.0.7-28.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name and remove upstream references from   fips_module_indicators manpage [Orabug: 35824276]  [3.0.7-28.0.1] - Drop OpenELA branding, apply Oracle branding patches - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.0.7-28] - Patch for CVE-2024-6119   Resolves: RHEL-55340 |
| medium | ELSA-2024-8446 (CVE-2024-6232) | python3@3.9.18-3.el9_4.5 | 0:3.9.18-3.el9_4.6 | [3.9.18-3.6] - Fix: CVE-2024-6232 - Resolves: RHEL-57421 |
| medium | ELSA-2024-8446 (CVE-2024-6232) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.18-3.el9_4.6 | [3.9.18-3.6] - Fix: CVE-2024-6232 - Resolves: RHEL-57421 |
| medium | ELSA-2024-9331 (CVE-2024-26458) | krb5-libs@1.21.1-2.0.1.el9_4 | 0:1.21.1-3.0.1.el9 | [1.21.1-3.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767]  [1.21.1-3] - CVE-2024-37370 CVE-2024-37371   Fix vulnerabilities in GSS message token handling   Resolves: RHEL-45402 RHEL-45392 |
| medium | ELSA-2024-9371 (CVE-2024-8088) | python3@3.9.18-3.el9_4.5 | 0:3.9.19-8.el9 | [3.9.19-8] - Security fix for CVE-2024-8088 Resolves: RHEL-55967  [3.9.19-7] - Security fix for CVE-2024-6923 Resolves: RHEL-53045  [3.9.19-6] - Ensure 3rd party extension modules for the debug build use the -O0 flag  [3.9.19-5] - Properly propagate the optimization flags to C extensions  [3.9.19-4] - Build Python with -O3 - https://fedoraproject.org/wiki/Changes/Python_built_with_gcc_O3  [3.9.19-3] - Security fix for CVE-2024-4032 Resolves: RHEL-44107  [3.9.19-2] - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40750  [3.9.19-1] - Update to 3.9.19 - Security fixes for CVE-2023-6597 and CVE-2024-0450 - Fix tests for XMLPullParser with Expat with fixed CVE Resolves: RHEL-33679, RHEL-33691 |
| medium | ELSA-2024-9371 (CVE-2024-8088) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.19-8.el9 | [3.9.19-8] - Security fix for CVE-2024-8088 Resolves: RHEL-55967  [3.9.19-7] - Security fix for CVE-2024-6923 Resolves: RHEL-53045  [3.9.19-6] - Ensure 3rd party extension modules for the debug build use the -O0 flag  [3.9.19-5] - Properly propagate the optimization flags to C extensions  [3.9.19-4] - Build Python with -O3 - https://fedoraproject.org/wiki/Changes/Python_built_with_gcc_O3  [3.9.19-3] - Security fix for CVE-2024-4032 Resolves: RHEL-44107  [3.9.19-2] - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40750  [3.9.19-1] - Update to 3.9.19 - Security fixes for CVE-2023-6597 and CVE-2024-0450 - Fix tests for XMLPullParser with Expat with fixed CVE Resolves: RHEL-33679, RHEL-33691 |
| medium | ELSA-2024-9404 (CVE-2024-2236) | libgcrypt@1.10.0-10.el9_2 | 0:1.10.0-11.el9 | [1.10.0-11] - Fix CVE-2024-2236 (RHEL-34579) |
| medium | ELSA-2024-9468 (CVE-2024-6232) | python3@3.9.18-3.el9_4.5 | 0:3.9.19-8.el9_5.1 | [3.9.19-8.1] - Security fix for CVE-2024-6232 Resolves: RHEL-57420 |
| medium | ELSA-2024-9468 (CVE-2024-6232) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.19-8.el9_5.1 | [3.9.19-8.1] - Security fix for CVE-2024-6232 Resolves: RHEL-57420 |
| medium | ELSA-2024-9541 (CVE-2024-50602) | expat@2.5.0-2.el9_4.1 | 0:2.5.0-3.el9_5.1 | [2.5.0-3.1] - Fix CVE-2024-50602 - Resolves: RHEL-65064  [2.5.0-3] - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 |
| medium | ELSA-2025-0925 (CVE-2019-12900) | bzip2-libs@1.0.8-8.el9 | 0:1.0.8-10.el9_5 | [1.0.8-10] - Revert the previous commit (introduced a regression) Resolves: CVE-2019-12900  [1.0.8-9] - Fix out of bounds access in BZ2_decompress Resolves: RHEL-65198 |
| medium | ELSA-2025-10407 (CVE-2025-47273) | python3-setuptools-wheel@53.0.0-12.el9_4.1 | 0:53.0.0-13.el9_6.1 | [53.0.0-13.1] - Security fix for CVE-2025-47273 Resolves: RHEL-96807 |
| medium | ELSA-2025-11140 (CVE-2025-4373) | glib2@2.68.4-14.el9_4.1 | 0:2.68.4-16.el9_6.2 | [2.68.4-16.2] - Add patches for CVE-2024-52533 and CVE-2025-4373 - Update GDateTime test for new tzdata - Resolves: RHEL-94290 - Resolves: RHEL-102845 |
| medium | ELSA-2025-12748 (CVE-2025-8058) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.23 | [2.34-168.0.1.23] - Forward-port Oracle patches for ol9-u6   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history: |
| medium | ELSA-2025-12748 (CVE-2025-8058) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.23 | [2.34-168.0.1.23] - Forward-port Oracle patches for ol9-u6   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history: |
| medium | ELSA-2025-12748 (CVE-2025-8058) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.23 | [2.34-168.0.1.23] - Forward-port Oracle patches for ol9-u6   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history: |
| medium | ELSA-2025-13428 (CVE-2025-32414) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-12.el9_6 | [2.9.13-12] - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) |
| medium | ELSA-2025-1346 (CVE-2020-11023) | libgcc@11.4.1-3.0.1.el9 | 0:11.5.0-5.0.1.el9_5 | [11.5.0-5.0.1] - Merge Oracle patches to 11.5.0-5.   Oracle history: |
| medium | ELSA-2025-1346 (CVE-2020-11023) | libgomp@11.4.1-3.0.1.el9 | 0:11.5.0-5.0.1.el9_5 | [11.5.0-5.0.1] - Merge Oracle patches to 11.5.0-5.   Oracle history: |
| medium | ELSA-2025-1346 (CVE-2020-11023) | libstdc++@11.4.1-3.0.1.el9 | 0:11.5.0-5.0.1.el9_5 | [11.5.0-5.0.1] - Merge Oracle patches to 11.5.0-5.   Oracle history: |
| medium | ELSA-2025-15019 (CVE-2025-8194) | python3@3.9.18-3.el9_4.5 | 0:3.9.21-2.el9_6.2 | [3.9.21-2.2] - Security fix for CVE-2025-8194 Resolves: RHEL-106375 |
| medium | ELSA-2025-15019 (CVE-2025-8194) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.21-2.el9_6.2 | [3.9.21-2.2] - Security fix for CVE-2025-8194 Resolves: RHEL-106375 |
| medium | ELSA-2025-16116 (CVE-2025-32989) | gnutls@3.8.3-4.el9_4 | 0:3.8.3-6.el9_6.2 | [3.8.3-6.2] - key_update: rework the rekeying logic (RHEL-107498)  [3.8.3-6.1] - Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and CVE-2025-6395 |
| medium | ELSA-2025-17558 (CVE-2025-48964) | iputils@20210202-9.0.1.el9 | 0:20210202-11.0.1.el9_6.3 | [20210202-11.0.1.3] - Upstream backport 'ping: Add SA_RESTART to sa_flags' [Orabug: 34573399]  [20210202-11.3] - Bump release  [20210202-11.2] - Fix CVE-2025-48964 iputils: iputils integer overflow (RHEL-112001)  [20210202-11.1] - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94335)  [20210202-11] - ping: Fix ping6 binding to VRF and address (RHEL-57734)  [20210202-10] - arping: Fix 1s delay on exit for unsolicited arpings (RHEL-34110) - arping: exit 0 if running in deadline mode and we see replies (RHEL-27718) - ping: Print reply with wrong source with warning & some follow-up fixes (RHEL-12789, RHEL-13480) - ping: Fix socket error reporting (RHEL-4608) |
| medium | ELSA-2025-17742 (CVE-2025-53906) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-22.0.1.el9_6.1 | [8.2.2637-22.0.1.1] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-22.1] - RHEL-112006 CVE-2025-53905 vim: Vim path traversial - RHEL-112010 CVE-2025-53906 vim: Vim path traversal  [2:8.2.2637-22] - RHEL-2159 vim: Heap Use After Free in function ins_compl_get_exp in vim/vim  [2:8.2.2637-21] - RHEL-40602 CVE-2021-3903 vim: heap-based buffer overflow vulnerability |
| medium | ELSA-2025-18275 (CVE-2025-5318) | libssh@0.10.4-13.el9 | 0:0.10.4-15.el9_6 | [0.10.4-15] - Rebuild due to broken build auto-tagging  [0.10.4-14] - Fix CVE-2025-5318   Resolves: RHEL-111730 |
| medium | ELSA-2025-18275 (CVE-2025-5318) | libssh-config@0.10.4-13.el9 | 0:0.10.4-15.el9_6 | [0.10.4-15] - Rebuild due to broken build auto-tagging  [0.10.4-14] - Fix CVE-2025-5318   Resolves: RHEL-111730 |
| medium | ELSA-2025-20606 (CVE-2025-32988) | gnutls@3.8.3-4.el9_4 | 10:3.8.3-6.el9_6.2_fips | [3.8.3-6.2_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409]  [3.8.3-6.2] - key_update: rework the rekeying logic (RHEL-107498)  [3.8.3-6.1] - Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and CVE-2025-6395 |
| medium | ELSA-2025-20943 (CVE-2025-5318) | libssh@0.10.4-13.el9 | 0:0.10.4-15.el9_7 | [0.10.4-15] - Bump spec to make the 9.7 NVR higher than the 9.6 one  [0.10.4-14] - Fix CVE-2025-5318   Resolves: RHEL-111732 |
| medium | ELSA-2025-20943 (CVE-2025-5318) | libssh-config@0.10.4-13.el9 | 0:0.10.4-15.el9_7 | [0.10.4-15] - Bump spec to make the 9.7 NVR higher than the 9.6 one  [0.10.4-14] - Fix CVE-2025-5318   Resolves: RHEL-111732 |
| medium | ELSA-2025-20945 (CVE-2025-53905) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-23.0.1.el9_7 | [8.2.2637-23.0.1] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-23] - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal |
| medium | ELSA-2025-21255 (CVE-2025-9230) | openssl@1:3.0.7-28.0.1.el9_4 | 1:3.5.1-4.0.1.el9_7 | [3.5.1-4.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-4] - Fix CVE-2025-9230   Resolves: RHEL-115929 |
| medium | ELSA-2025-21255 (CVE-2025-9230) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 1:3.5.1-4.0.1.el9_7 | [3.5.1-4.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-4] - Fix CVE-2025-9230   Resolves: RHEL-115929 |
| medium | ELSA-2025-22376 (CVE-2025-9714) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-14.el9_7 | [2.9.13-14] - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283)  [2.9.13-13] - Fix CVE-2025-9714 (RHEL-119283) |
| medium | ELSA-2025-22660 (CVE-2025-4598) | systemd@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.7 | [252-55.0.3.7] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.7] - core: fix array size in unit_log_resources() (RHEL-132120)  [252-55.6] - timer: rebase last_trigger timestamp if needed (RHEL-127022)  [252-55.5] - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-127022) - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-127022) - test: check the next elapse timer timestamp after deserialization (RHEL-127022) - timer: don't run service immediately after restart of a timer (RHEL-127022) - test: store and compare just the property value (RHEL-127022) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-127022) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126114)  [252-55.4] - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-118294) - cryptsetup: fix typo (RHEL-118294) - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-118294) - basic: add PIDFS magic (#31709) (RHEL-118294) - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-118294) - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138) - coredump: restore compatibility with older patterns (RHEL-104138) - coredump: use %d in kernel core pattern (RHEL-104138) - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138) - fd-util: introduce parse_fd() (RHEL-104138) - coredump: add support for new %F PIDFD specifier (RHEL-104138)  [252-55.2] - Revert 'test-time-util: disable failing tests' (RHEL-110954) - test: use get_timezones() to iterate all known timezones (RHEL-110954) - test-time-util: do not fail on DST change (RHEL-110954) - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-110954) - test-time-util: do more suppression of time zone checks (RHEL-110954) - test-time-util: fix truncation of usec to sec (RHEL-110954) - test: unset TZ before timezone-sensitive unit tests are run (RHEL-110954) - meson: extend timeout for test-time-util (RHEL-110954) - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-110954) - time-util: align string table (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: add assertions (RHEL-110954) - time-util: drop redundant else (RHEL-110954) - time-util: do not use strdupa() (RHEL-110954) - time-util: use result from startswith_no_case() (RHEL-110954) - time-util: use usec_add() and usec_sub_unsigned() (RHEL-110954) - time-util: shorten code a bit (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: drop unnecessary assignment of timezone name (RHEL-110954) - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-110954) - time-util: fix typo (RHEL-110954) - ci: bump the tools tree to F42 (RHEL-110954)  [252-55.1] - meson: /etc/systemd/network is also used by udevd (RHEL-111611) - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-110954) - test-time-util: disable failing tests (RHEL-110954) - test: test parse_timestamp() in various timezone (RHEL-110954) - systemctl: logind: add missing asserts (RHEL-110954) - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-110954) - systemctl: add option --when for scheduled shutdown (RHEL-110954) - test-time-util: add test cases to invalidate 'show' and 'cancel' (RHEL-110954) - sd-bus: make bus_add_match_full accept timeout (RHEL-111630) - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111630) - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111630) - core,sd-bus: drop empty lines between function call and error check (RHEL-111630) - core: do not disconnect from bus when failed to install signal match (RHEL-111630) - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111630) - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111630) - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111630) - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111630) - core/manager: drop duplicate bus track deserialization (RHEL-111630) - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111630) |
| medium | ELSA-2025-22660 (CVE-2025-4598) | systemd-libs@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.7 | [252-55.0.3.7] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.7] - core: fix array size in unit_log_resources() (RHEL-132120)  [252-55.6] - timer: rebase last_trigger timestamp if needed (RHEL-127022)  [252-55.5] - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-127022) - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-127022) - test: check the next elapse timer timestamp after deserialization (RHEL-127022) - timer: don't run service immediately after restart of a timer (RHEL-127022) - test: store and compare just the property value (RHEL-127022) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-127022) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126114)  [252-55.4] - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-118294) - cryptsetup: fix typo (RHEL-118294) - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-118294) - basic: add PIDFS magic (#31709) (RHEL-118294) - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-118294) - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138) - coredump: restore compatibility with older patterns (RHEL-104138) - coredump: use %d in kernel core pattern (RHEL-104138) - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138) - fd-util: introduce parse_fd() (RHEL-104138) - coredump: add support for new %F PIDFD specifier (RHEL-104138)  [252-55.2] - Revert 'test-time-util: disable failing tests' (RHEL-110954) - test: use get_timezones() to iterate all known timezones (RHEL-110954) - test-time-util: do not fail on DST change (RHEL-110954) - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-110954) - test-time-util: do more suppression of time zone checks (RHEL-110954) - test-time-util: fix truncation of usec to sec (RHEL-110954) - test: unset TZ before timezone-sensitive unit tests are run (RHEL-110954) - meson: extend timeout for test-time-util (RHEL-110954) - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-110954) - time-util: align string table (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: add assertions (RHEL-110954) - time-util: drop redundant else (RHEL-110954) - time-util: do not use strdupa() (RHEL-110954) - time-util: use result from startswith_no_case() (RHEL-110954) - time-util: use usec_add() and usec_sub_unsigned() (RHEL-110954) - time-util: shorten code a bit (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: drop unnecessary assignment of timezone name (RHEL-110954) - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-110954) - time-util: fix typo (RHEL-110954) - ci: bump the tools tree to F42 (RHEL-110954)  [252-55.1] - meson: /etc/systemd/network is also used by udevd (RHEL-111611) - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-110954) - test-time-util: disable failing tests (RHEL-110954) - test: test parse_timestamp() in various timezone (RHEL-110954) - systemctl: logind: add missing asserts (RHEL-110954) - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-110954) - systemctl: add option --when for scheduled shutdown (RHEL-110954) - test-time-util: add test cases to invalidate 'show' and 'cancel' (RHEL-110954) - sd-bus: make bus_add_match_full accept timeout (RHEL-111630) - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111630) - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111630) - core,sd-bus: drop empty lines between function call and error check (RHEL-111630) - core: do not disconnect from bus when failed to install signal match (RHEL-111630) - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111630) - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111630) - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111630) - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111630) - core/manager: drop duplicate bus track deserialization (RHEL-111630) - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111630) |
| medium | ELSA-2025-22660 (CVE-2025-4598) | systemd-pam@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.7 | [252-55.0.3.7] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.7] - core: fix array size in unit_log_resources() (RHEL-132120)  [252-55.6] - timer: rebase last_trigger timestamp if needed (RHEL-127022)  [252-55.5] - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-127022) - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-127022) - test: check the next elapse timer timestamp after deserialization (RHEL-127022) - timer: don't run service immediately after restart of a timer (RHEL-127022) - test: store and compare just the property value (RHEL-127022) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-127022) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126114)  [252-55.4] - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-118294) - cryptsetup: fix typo (RHEL-118294) - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-118294) - basic: add PIDFS magic (#31709) (RHEL-118294) - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-118294) - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138) - coredump: restore compatibility with older patterns (RHEL-104138) - coredump: use %d in kernel core pattern (RHEL-104138) - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138) - fd-util: introduce parse_fd() (RHEL-104138) - coredump: add support for new %F PIDFD specifier (RHEL-104138)  [252-55.2] - Revert 'test-time-util: disable failing tests' (RHEL-110954) - test: use get_timezones() to iterate all known timezones (RHEL-110954) - test-time-util: do not fail on DST change (RHEL-110954) - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-110954) - test-time-util: do more suppression of time zone checks (RHEL-110954) - test-time-util: fix truncation of usec to sec (RHEL-110954) - test: unset TZ before timezone-sensitive unit tests are run (RHEL-110954) - meson: extend timeout for test-time-util (RHEL-110954) - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-110954) - time-util: align string table (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: add assertions (RHEL-110954) - time-util: drop redundant else (RHEL-110954) - time-util: do not use strdupa() (RHEL-110954) - time-util: use result from startswith_no_case() (RHEL-110954) - time-util: use usec_add() and usec_sub_unsigned() (RHEL-110954) - time-util: shorten code a bit (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: drop unnecessary assignment of timezone name (RHEL-110954) - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-110954) - time-util: fix typo (RHEL-110954) - ci: bump the tools tree to F42 (RHEL-110954)  [252-55.1] - meson: /etc/systemd/network is also used by udevd (RHEL-111611) - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-110954) - test-time-util: disable failing tests (RHEL-110954) - test: test parse_timestamp() in various timezone (RHEL-110954) - systemctl: logind: add missing asserts (RHEL-110954) - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-110954) - systemctl: add option --when for scheduled shutdown (RHEL-110954) - test-time-util: add test cases to invalidate 'show' and 'cancel' (RHEL-110954) - sd-bus: make bus_add_match_full accept timeout (RHEL-111630) - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111630) - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111630) - core,sd-bus: drop empty lines between function call and error check (RHEL-111630) - core: do not disconnect from bus when failed to install signal match (RHEL-111630) - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111630) - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111630) - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111630) - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111630) - core/manager: drop duplicate bus track deserialization (RHEL-111630) - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111630) |
| medium | ELSA-2025-22660 (CVE-2025-4598) | systemd-rpm-macros@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.7 | [252-55.0.3.7] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.7] - core: fix array size in unit_log_resources() (RHEL-132120)  [252-55.6] - timer: rebase last_trigger timestamp if needed (RHEL-127022)  [252-55.5] - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-127022) - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-127022) - test: check the next elapse timer timestamp after deserialization (RHEL-127022) - timer: don't run service immediately after restart of a timer (RHEL-127022) - test: store and compare just the property value (RHEL-127022) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-127022) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126114)  [252-55.4] - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-118294) - cryptsetup: fix typo (RHEL-118294) - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-118294) - basic: add PIDFS magic (#31709) (RHEL-118294) - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-118294) - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138) - coredump: restore compatibility with older patterns (RHEL-104138) - coredump: use %d in kernel core pattern (RHEL-104138) - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138) - fd-util: introduce parse_fd() (RHEL-104138) - coredump: add support for new %F PIDFD specifier (RHEL-104138)  [252-55.2] - Revert 'test-time-util: disable failing tests' (RHEL-110954) - test: use get_timezones() to iterate all known timezones (RHEL-110954) - test-time-util: do not fail on DST change (RHEL-110954) - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-110954) - test-time-util: do more suppression of time zone checks (RHEL-110954) - test-time-util: fix truncation of usec to sec (RHEL-110954) - test: unset TZ before timezone-sensitive unit tests are run (RHEL-110954) - meson: extend timeout for test-time-util (RHEL-110954) - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-110954) - time-util: align string table (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: add assertions (RHEL-110954) - time-util: drop redundant else (RHEL-110954) - time-util: do not use strdupa() (RHEL-110954) - time-util: use result from startswith_no_case() (RHEL-110954) - time-util: use usec_add() and usec_sub_unsigned() (RHEL-110954) - time-util: shorten code a bit (RHEL-110954) - time-util: rename variables (RHEL-110954) - time-util: drop unnecessary assignment of timezone name (RHEL-110954) - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-110954) - time-util: fix typo (RHEL-110954) - ci: bump the tools tree to F42 (RHEL-110954)  [252-55.1] - meson: /etc/systemd/network is also used by udevd (RHEL-111611) - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-110954) - test-time-util: disable failing tests (RHEL-110954) - test: test parse_timestamp() in various timezone (RHEL-110954) - systemctl: logind: add missing asserts (RHEL-110954) - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-110954) - systemctl: add option --when for scheduled shutdown (RHEL-110954) - test-time-util: add test cases to invalidate 'show' and 'cancel' (RHEL-110954) - sd-bus: make bus_add_match_full accept timeout (RHEL-111630) - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111630) - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111630) - core,sd-bus: drop empty lines between function call and error check (RHEL-111630) - core: do not disconnect from bus when failed to install signal match (RHEL-111630) - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111630) - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111630) - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111630) - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111630) - core/manager: drop duplicate bus track deserialization (RHEL-111630) - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111630) |
| medium | ELSA-2025-23342 (CVE-2024-5642) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-2.0.1.el9_7 | [3.9.25-2.0.1] - Remove upstream URL reference  [3.9.25-2] - Move _sysconfigdata_d_linux*.py to the debug subpackage  [3.9.25-1] - Update to Python 3.9.25  [3.9.24-1] - Update to Python 3.9.24 |
| medium | ELSA-2025-23342 (CVE-2024-5642) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-2.0.1.el9_7 | [3.9.25-2.0.1] - Remove upstream URL reference  [3.9.25-2] - Move _sysconfigdata_d_linux*.py to the debug subpackage  [3.9.25-1] - Update to Python 3.9.25  [3.9.24-1] - Update to Python 3.9.24 |
| medium | ELSA-2025-23480 (CVE-2025-61984) | openssh@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-47.0.1.el9_7 | [8.7p1-47.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-47] - CVE-2025-61984: Reject usernames with control characters   Resolves: RHEL-128401 - CVE-2025-61985: Reject URL-strings with NULL characters   Resolves: RHEL-128392 |
| medium | ELSA-2025-23480 (CVE-2025-61984) | openssh-clients@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-47.0.1.el9_7 | [8.7p1-47.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-47] - CVE-2025-61984: Reject usernames with control characters   Resolves: RHEL-128401 - CVE-2025-61985: Reject URL-strings with NULL characters   Resolves: RHEL-128392 |
| medium | ELSA-2025-23480 (CVE-2025-61984) | openssh-server@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-47.0.1.el9_7 | [8.7p1-47.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-47] - CVE-2025-61984: Reject usernames with control characters   Resolves: RHEL-128401 - CVE-2025-61985: Reject URL-strings with NULL characters   Resolves: RHEL-128392 |
| medium | ELSA-2025-23483 (CVE-2025-5987) | libssh@0.10.4-13.el9 | 0:0.10.4-17.el9_7 | [0.10.4-17] - Bump spec to resolve build tagging issues  [0.10.4-16] - Fix CVE-2025-5987   Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests   Resolves: RHEL-135506 |
| medium | ELSA-2025-23483 (CVE-2025-5987) | libssh-config@0.10.4-13.el9 | 0:0.10.4-17.el9_7 | [0.10.4-17] - Bump spec to resolve build tagging issues  [0.10.4-16] - Fix CVE-2025-5987   Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests   Resolves: RHEL-135506 |
| medium | ELSA-2025-28011 (CVE-2025-9230) | openssl@1:3.0.7-28.0.1.el9_4 | 10:3.5.1-4.0.2.el9_7_fips | [3.5.1-4.0.2_fips] - Update additional upstream references  [3.5.1-4.0.1_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276]  [3.5.1-4.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-4] - Fix CVE-2025-9230   Resolves: RHEL-115929  [1:3.5.1-3] - Add custom define to disable symbol versioning in downstream patched code   Also add stricter Suggests for openssl-fips-provider   Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers   Resolves: RHEL-104856  [1:3.5.1-2] - Move fips.so to a seprate subpackage   Reverts FIPS self test for SLH-DSA   Add Suggests to try to prefer the openssl-fips-provider package   over the fips-provider-next package by default   Revolves: RHEL-102408   Related: RHEL-80854  [1:3.5.1-1] - Rebasing to OpenSSL 3.5.1   Resolves: RHEL-97797   Resolves: RHEL-98723   Resolves: RHEL-99352  [1:3.5.0-4] - Compact patches for better maintainability   Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7)   Resolves: RHEL-95239  [1:3.5.0-3] - Fix regressions caused by rebase to OpenSSL 3.5   Related: RHEL-80854 |
| medium | ELSA-2025-28011 (CVE-2025-9230) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 10:3.5.1-4.0.2.el9_7_fips | [3.5.1-4.0.2_fips] - Update additional upstream references  [3.5.1-4.0.1_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276]  [3.5.1-4.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.1.openela.0.1] - Add OpenELA specific changes  [1:3.5.1-4] - Fix CVE-2025-9230   Resolves: RHEL-115929  [1:3.5.1-3] - Add custom define to disable symbol versioning in downstream patched code   Also add stricter Suggests for openssl-fips-provider   Resolves: RHEL-104236 - Fix Requires/Provider to fix default install of fips providers   Resolves: RHEL-104856  [1:3.5.1-2] - Move fips.so to a seprate subpackage   Reverts FIPS self test for SLH-DSA   Add Suggests to try to prefer the openssl-fips-provider package   over the fips-provider-next package by default   Revolves: RHEL-102408   Related: RHEL-80854  [1:3.5.1-1] - Rebasing to OpenSSL 3.5.1   Resolves: RHEL-97797   Resolves: RHEL-98723   Resolves: RHEL-99352  [1:3.5.0-4] - Compact patches for better maintainability   Related: RHEL-80854 - Make hybrid MLKEM work with our FIPS provider (3.0.7)   Resolves: RHEL-95239  [1:3.5.0-3] - Fix regressions caused by rebase to OpenSSL 3.5   Related: RHEL-80854 |
| medium | ELSA-2025-3531 (CVE-2024-8176) | expat@2.5.0-2.el9_4.1 | 0:2.5.0-3.el9_5.3 | [2.5.0-3.3] - Improve fix for CVE-2024-8176 - Resolves: RHEL-57488  [2.5.0-3.2] - Fix CVE-2024-8176 - Resolves: RHEL-57488 |
| medium | ELSA-2025-4244 (CVE-2025-0395) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-125.0.1.el9_5.8 | [2.34-125.0.1.8] - Forward-port Oracle patches for ol9-u5 (glibc-2.34-125.0.1.8)   Reviewed by: David Faust <david.faust@oracle.com>   Oracle history: |
| medium | ELSA-2025-4244 (CVE-2025-0395) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-125.0.1.el9_5.8 | [2.34-125.0.1.8] - Forward-port Oracle patches for ol9-u5 (glibc-2.34-125.0.1.8)   Reviewed by: David Faust <david.faust@oracle.com>   Oracle history: |
| medium | ELSA-2025-4244 (CVE-2025-0395) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-125.0.1.el9_5.8 | [2.34-125.0.1.8] - Forward-port Oracle patches for ol9-u5 (glibc-2.34-125.0.1.8)   Reviewed by: David Faust <david.faust@oracle.com>   Oracle history: |
| medium | ELSA-2025-6977 (CVE-2025-0938) | python3@3.9.18-3.el9_4.5 | 0:3.9.21-2.el9 | [3.9.21-2] - Security fix for CVE-2025-0938 Resolves: RHEL-77263 |
| medium | ELSA-2025-6977 (CVE-2025-0938) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.21-2.el9 | [3.9.21-2] - Security fix for CVE-2025-0938 Resolves: RHEL-77263 |
| medium | ELSA-2025-6993 (CVE-2025-26465) | openssh@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-45.0.2.el9 | [8.7p1-45.0.2] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [8.7p1-45.0.1] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-45] - Fix missing error codes set and invalid error code checks in OpenSSH. It   prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS   is on (CVE-2025-26465).   Resolves: RHEL-78700  [8.7p1-44] - Add extra help information on ssh early failure   Resolves: RHEL-33809 - Provide details on crypto error instead of 'error in libcrypto'   Resolves: RHEL-52293 - Allow duplicate Subsystem directive   Resolves: RHEL-47112 |
| medium | ELSA-2025-6993 (CVE-2025-26465) | openssh-clients@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-45.0.2.el9 | [8.7p1-45.0.2] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [8.7p1-45.0.1] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-45] - Fix missing error codes set and invalid error code checks in OpenSSH. It   prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS   is on (CVE-2025-26465).   Resolves: RHEL-78700  [8.7p1-44] - Add extra help information on ssh early failure   Resolves: RHEL-33809 - Provide details on crypto error instead of 'error in libcrypto'   Resolves: RHEL-52293 - Allow duplicate Subsystem directive   Resolves: RHEL-47112 |
| medium | ELSA-2025-6993 (CVE-2025-26465) | openssh-server@8.7p1-38.0.2.el9_4.4 | 0:8.7p1-45.0.2.el9 | [8.7p1-45.0.2] - Upstream references found with /usr/bin/ssh [Orabug: 37814929]  [8.7p1-45.0.1] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626]  [8.7p1-45] - Fix missing error codes set and invalid error code checks in OpenSSH. It   prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS   is on (CVE-2025-26465).   Resolves: RHEL-78700  [8.7p1-44] - Add extra help information on ssh early failure   Resolves: RHEL-33809 - Provide details on crypto error instead of 'error in libcrypto'   Resolves: RHEL-52293 - Allow duplicate Subsystem directive   Resolves: RHEL-47112 |
| medium | ELSA-2025-7067 (CVE-2025-24528) | krb5-libs@1.21.1-2.0.1.el9_4 | 0:1.21.1-6.0.1.el9 | [1.21.1-6.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767]  [1.21.1-6] - Prevent overflow when calculating ulog block size (CVE-2025-24528)   Resolves: RHEL-76759  [1.21.1-5] - Support PKCS11 EC client certs in PKINIT   Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification   Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349)   Resolves: RHEL-4902 |
| medium | ELSA-2025-7076 (CVE-2024-12243) | gnutls@3.8.3-4.el9_4 | 0:3.8.3-6.el9 | [3.8.3-6] - Bump nettle dependency to 3.10.1 (RHEL-52740)  [3.8.3-5] - Backport the fix for CVE-2024-12243 (RHEL-78580) |
| medium | ELSA-2025-7077 (CVE-2024-12133) | libtasn1@4.16.0-8.el9_1 | 0:4.16.0-9.el9 | [4.16.0-9] - Backport the fix for CVE-2024-12133 (RHEL-78580) |
| medium | ELSA-2025-7444 (CVE-2024-8176) | expat@2.5.0-2.el9_4.1 | 0:2.5.0-5.el9_6 | [2.5.0-5] - Fix CVE-2024-8176 - Resolves: RHEL-57489  [2.5.0-4] - Fix CVE-2024-50602 - Resolves: RHEL-65066 |
| medium | ELSA-2025-8655 (CVE-2025-4802) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.19 | [2.34-168.0.1.19] - Forward-port Oracle patches for ol9-u6   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history: |
| medium | ELSA-2025-8655 (CVE-2025-4802) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.19 | [2.34-168.0.1.19] - Forward-port Oracle patches for ol9-u6   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history: |
| medium | ELSA-2025-8655 (CVE-2025-4802) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.19 | [2.34-168.0.1.19] - Forward-port Oracle patches for ol9-u6   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history: |
| medium | ELSA-2025-9430 (CVE-2025-3576) | krb5-libs@1.21.1-2.0.1.el9_4 | 0:1.21.1-8.0.1.el9_6 | [1.21.1-8.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767]  [1.21.1-9] - Do not block HMAC-MD4/5 in FIPS mode   Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576)   Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920   Resolves: RHEL-82647  [1.21.1-7] - Add dedicated tests sub-package |
| medium | ELSA-2025-9431 (CVE-2025-25724) | libarchive@3.5.3-4.el9 | 0:3.5.3-5.el9_6 | [3.5.3-5] - Resolves: CVE-2025-25724 |
| medium | ELSA-2025-9432 (CVE-2025-47268) | iputils@20210202-9.0.1.el9 | 0:20210202-11.0.1.el9_6.1 | [20210202-11.0.1.1] - Upstream backport 'ping: Add SA_RESTART to sa_flags' [Orabug: 34573399]  [20210202-11.1] - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94335)  [20210202-11] - ping: Fix ping6 binding to VRF and address (RHEL-57734)  [20210202-10] - arping: Fix 1s delay on exit for unsolicited arpings (RHEL-34110) - arping: exit 0 if running in deadline mode and we see replies (RHEL-27718) - ping: Print reply with wrong source with warning & some follow-up fixes (RHEL-12789, RHEL-13480) - ping: Fix socket error reporting (RHEL-4608) |
| medium | ELSA-2025-9877 (CVE-2025-5702) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.20 | [2.34-168.0.1.20] - Forward-port Oracle patches for ol9-u6   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history: |
| medium | ELSA-2025-9877 (CVE-2025-5702) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.20 | [2.34-168.0.1.20] - Forward-port Oracle patches for ol9-u6   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history: |
| medium | ELSA-2025-9877 (CVE-2025-5702) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-168.0.1.el9_6.20 | [2.34-168.0.1.20] - Forward-port Oracle patches for ol9-u6   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history: |
| medium | ELSA-2026-0067 (CVE-2025-45582) | tar@2:1.34-6.el9_4.1 | 2:1.34-9.el9_7 | [2:1.34-9] - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277   also, fix another tiny mistake in the patch (w/o visible consequences)  [2:1.34-8] - Backport upstream changes to jailify extraction directory   Includes related gnulib changes to add openat2   Fixes CVE-2025-45582 |
| medium | ELSA-2026-0936 (CVE-2025-13601) | glib2@2.68.4-14.el9_4.1 | 0:2.68.4-18.el9_7.1 | [2.68.4-18.1] - Add patch for CVE-2025-13601 |
| medium | ELSA-2026-1350 (CVE-2025-9086) | curl@7.76.1-29.el9_4.1 | 0:7.76.1-35.el9_7.3 | [7.76.1-35.el9_7.3] - http: fix crash in rate-limited upload (RHEL-129493)  [7.76.1-35.el9_7.2] - openssl: respect system crypto policy for TLS max version (RHEL-128921)  [7.76.1-35.el9_7.1] - rebuild for rhel-9.7.0 z-stream (RHEL-121659)  [7.76.1-35] - cookie: don't treat the leading slash as trailing (CVE-2025-9086)   Resolves: RHEL-121659 |
| medium | ELSA-2026-1350 (CVE-2025-9086) | libcurl@7.76.1-29.el9_4.1 | 0:7.76.1-35.el9_7.3 | [7.76.1-35.el9_7.3] - http: fix crash in rate-limited upload (RHEL-129493)  [7.76.1-35.el9_7.2] - openssl: respect system crypto policy for TLS max version (RHEL-128921)  [7.76.1-35.el9_7.1] - rebuild for rhel-9.7.0 z-stream (RHEL-121659)  [7.76.1-35] - cookie: don't treat the leading slash as trailing (CVE-2025-9086)   Resolves: RHEL-121659 |
| medium | ELSA-2026-13677 (CVE-2026-29111) | systemd@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.9 | [252-55.0.3.el9_7.9] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.9] - core: validate input cgroup path more prudently (RHEL-155391) |
| medium | ELSA-2026-13677 (CVE-2026-29111) | systemd-libs@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.9 | [252-55.0.3.el9_7.9] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.9] - core: validate input cgroup path more prudently (RHEL-155391) |
| medium | ELSA-2026-13677 (CVE-2026-29111) | systemd-pam@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.9 | [252-55.0.3.el9_7.9] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.9] - core: validate input cgroup path more prudently (RHEL-155391) |
| medium | ELSA-2026-13677 (CVE-2026-29111) | systemd-rpm-macros@252-32.0.2.el9_4.7 | 0:252-55.0.3.el9_7.9 | [252-55.0.3.el9_7.9] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-55.9] - core: validate input cgroup path more prudently (RHEL-155391) |
| medium | ELSA-2026-1478 (CVE-2025-12084) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7 | [3.9.25-3.0.1] - Remove upstream URL reference  [3.9.25-3] - Security fix for CVE-2025-12084 Resolves: RHEL-135897 |
| medium | ELSA-2026-1478 (CVE-2025-12084) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7 | [3.9.25-3.0.1] - Remove upstream URL reference  [3.9.25-3] - Security fix for CVE-2025-12084 Resolves: RHEL-135897 |
| medium | ELSA-2026-15971 (CVE-2025-14087) | glib2@2.68.4-14.el9_4.1 | 0:2.68.4-18.el9_7.2 | [2.68.4-18.2] - Add patch for CVE-2025-14087 and CVE-2025-14512 |
| medium | ELSA-2026-18599 (CVE-2026-2100) | p11-kit@0.25.3-2.el9 | 0:0.26.2-1.el9 | [0.26.2-1] - Rebase to 0.26.2   Resolves: RHEL-147825  [0.26.1-1] - Rebase to 0.26.1   Resolves: RHEL-139075, RHEL-118361, RHEL-126132  [0.25.10-1] - Update to new upstream release 0.25.10   Resolves: RHEL-115453 |
| medium | ELSA-2026-18599 (CVE-2026-2100) | p11-kit-trust@0.25.3-2.el9 | 0:0.26.2-1.el9 | [0.26.2-1] - Rebase to 0.26.2   Resolves: RHEL-147825  [0.26.1-1] - Rebase to 0.26.1   Resolves: RHEL-139075, RHEL-118361, RHEL-126132  [0.25.10-1] - Update to new upstream release 0.25.10   Resolves: RHEL-115453 |
| medium | ELSA-2026-18683 (CVE-2025-4877) | libssh@0.10.4-13.el9 | 0:0.10.4-18.el9 | [0.10.4-18] - Resolves: RHEL-150661 - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves: CVE-2026-0964 - Resolves: CVE-2026-0965 - Resolves: CVE-2026-0966 - Resolves: CVE-2026-0967 - Resolves: CVE-2026-0968 |
| medium | ELSA-2026-18683 (CVE-2025-4877) | libssh-config@0.10.4-13.el9 | 0:0.10.4-18.el9 | [0.10.4-18] - Resolves: RHEL-150661 - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves: CVE-2026-0964 - Resolves: CVE-2026-0965 - Resolves: CVE-2026-0966 - Resolves: CVE-2026-0967 - Resolves: CVE-2026-0968 |
| medium | ELSA-2026-18693 (CVE-2026-0865) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8 | [3.9.25-7.0.1] - Remove upstream URL reference  [3.9.25-7] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161  [3.9.25-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158117  [3.9.25-5] - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897  [3.9.25-4] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 |
| medium | ELSA-2026-18693 (CVE-2026-0865) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-7.0.1.el9_8 | [3.9.25-7.0.1] - Remove upstream URL reference  [3.9.25-7] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161  [3.9.25-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158117  [3.9.25-5] - Rebuilding previous fixes for different build target Related: RHEL-143117, RHEL-143174, RHEL-144897  [3.9.25-4] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143117 Resolves: RHEL-143174 Resolves: RHEL-144897 |
| medium | ELSA-2026-1913 (CVE-2025-14104) | libblkid@2.37.4-18.0.1.el9 | 0:2.37.4-21.0.1.el9_7 | [2.37.4-21.0.1] - Orabug 35995271 - report lost loop device |
| medium | ELSA-2026-1913 (CVE-2025-14104) | libfdisk@2.37.4-18.0.1.el9 | 0:2.37.4-21.0.1.el9_7 | [2.37.4-21.0.1] - Orabug 35995271 - report lost loop device |
| medium | ELSA-2026-1913 (CVE-2025-14104) | libmount@2.37.4-18.0.1.el9 | 0:2.37.4-21.0.1.el9_7 | [2.37.4-21.0.1] - Orabug 35995271 - report lost loop device |
| medium | ELSA-2026-1913 (CVE-2025-14104) | libsmartcols@2.37.4-18.0.1.el9 | 0:2.37.4-21.0.1.el9_7 | [2.37.4-21.0.1] - Orabug 35995271 - report lost loop device |
| medium | ELSA-2026-1913 (CVE-2025-14104) | libuuid@2.37.4-18.0.1.el9 | 0:2.37.4-21.0.1.el9_7 | [2.37.4-21.0.1] - Orabug 35995271 - report lost loop device |
| medium | ELSA-2026-1913 (CVE-2025-14104) | util-linux@2.37.4-18.0.1.el9 | 0:2.37.4-21.0.1.el9_7 | [2.37.4-21.0.1] - Orabug 35995271 - report lost loop device |
| medium | ELSA-2026-1913 (CVE-2025-14104) | util-linux-core@2.37.4-18.0.1.el9 | 0:2.37.4-21.0.1.el9_7 | [2.37.4-21.0.1] - Orabug 35995271 - report lost loop device |
| medium | ELSA-2026-19213 (CVE-2026-29111) | systemd@252-32.0.2.el9_4.7 | 0:252-67.0.1.el9_8.2 | [252-67.0.1.el9_8.2] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-67.2] - core: validate input cgroup path more prudently (RHEL-152082)  [252-67.1] - manager: fix scope for environment generators (RHEL-154262)  [252-67] - core: only activate transaction that contain useful jobs (RHEL-143727)  [252-66] - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252)  [252-65] - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)  [252-64] - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153)  [252-63] - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add 'background-light' session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833)  [252-62] - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215)  [252-61] - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) |
| medium | ELSA-2026-19213 (CVE-2026-29111) | systemd-libs@252-32.0.2.el9_4.7 | 0:252-67.0.1.el9_8.2 | [252-67.0.1.el9_8.2] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-67.2] - core: validate input cgroup path more prudently (RHEL-152082)  [252-67.1] - manager: fix scope for environment generators (RHEL-154262)  [252-67] - core: only activate transaction that contain useful jobs (RHEL-143727)  [252-66] - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252)  [252-65] - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)  [252-64] - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153)  [252-63] - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add 'background-light' session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833)  [252-62] - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215)  [252-61] - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) |
| medium | ELSA-2026-19213 (CVE-2026-29111) | systemd-pam@252-32.0.2.el9_4.7 | 0:252-67.0.1.el9_8.2 | [252-67.0.1.el9_8.2] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-67.2] - core: validate input cgroup path more prudently (RHEL-152082)  [252-67.1] - manager: fix scope for environment generators (RHEL-154262)  [252-67] - core: only activate transaction that contain useful jobs (RHEL-143727)  [252-66] - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252)  [252-65] - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)  [252-64] - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153)  [252-63] - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add 'background-light' session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833)  [252-62] - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215)  [252-61] - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) |
| medium | ELSA-2026-19213 (CVE-2026-29111) | systemd-rpm-macros@252-32.0.2.el9_4.7 | 0:252-67.0.1.el9_8.2 | [252-67.0.1.el9_8.2] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve logging for api bus connection and subscribers [Orabug: 38040980] - Defer processing of timeout events in sd-bus api [Orabug: 38064217] - coredump: use %d in kernel core pattern - CVE-2025-4598 - Add bus description to sd-bus outgoing sockets [Orabug: 37347576] - Add log messages about daemon-reload requester and duration [Orabug: 37347576] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319] - 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319] - Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to - previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224] - Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved. - Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references  [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - shutdown: get only active md arrays. [Orabug: 34467234] - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407] - Removed unneeded patches from the systemd.spec - 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490] - 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490] - 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110] - Removed the following, associated with [Orabug: 36269319]: - 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch - 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319] - 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319] - 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319] - 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]  [252-67.2] - core: validate input cgroup path more prudently (RHEL-152082)  [252-67.1] - manager: fix scope for environment generators (RHEL-154262)  [252-67] - core: only activate transaction that contain useful jobs (RHEL-143727)  [252-66] - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252)  [252-65] - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)  [252-64] - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153)  [252-63] - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add 'background-light' session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833)  [252-62] - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215)  [252-61] - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) |
| medium | ELSA-2026-19218 (CVE-2026-31790) | openssl@1:3.0.7-28.0.1.el9_4 | 1:3.5.5-2.0.1.el9_8 | [3.5.5-2.0.1] - Replace upstream references [Orabug: 34340177]  [1:3.5.5-2] - Fix CVE-2026-31790   Resolves: RHEL-161586  [1:3.5.5-1] - Rebase to OpenSSL 3.5.5   Resolves: RHEL-136895   Resolves: RHEL-142004   Resolves: RHEL-142012   Resolves: RHEL-142020   Resolves: RHEL-142024   Resolves: RHEL-142028   Resolves: RHEL-142032   Resolves: RHEL-142036   Resolves: RHEL-142040   Resolves: RHEL-142044   Resolves: RHEL-142048   Resolves: RHEL-142052   Resolves: RHEL-142056 |
| medium | ELSA-2026-19218 (CVE-2026-31790) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 1:3.5.5-2.0.1.el9_8 | [3.5.5-2.0.1] - Replace upstream references [Orabug: 34340177]  [1:3.5.5-2] - Fix CVE-2026-31790   Resolves: RHEL-161586  [1:3.5.5-1] - Rebase to OpenSSL 3.5.5   Resolves: RHEL-136895   Resolves: RHEL-142004   Resolves: RHEL-142012   Resolves: RHEL-142020   Resolves: RHEL-142024   Resolves: RHEL-142028   Resolves: RHEL-142032   Resolves: RHEL-142036   Resolves: RHEL-142040   Resolves: RHEL-142044   Resolves: RHEL-142048   Resolves: RHEL-142052   Resolves: RHEL-142056 |
| medium | ELSA-2026-19361 (CVE-2025-14087) | glib2@2.68.4-14.el9_4.1 | 0:2.68.4-19.el9_8.1 | [2.68.4-19.1] - Add patch for CVE-2025-14087 and CVE-2025-14512 |
| medium | ELSA-2026-20597 (CVE-2026-4046) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-270.0.1.el9_8 | [2.34-270.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history:   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-270] - Fix incorrect setting of CXX variable in spec file (RHEL-148252)  [2.34-269] - Fix __nss_get_default_domain logic to restore netgroup user enumeration   (RHEL-168096)  [2.34-268] - resolv: Correctly count records and check hostname validity (RHEL-168851,   RHEL-168852)  [2.34-267] - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules   (RHEL-162901) |
| medium | ELSA-2026-20597 (CVE-2026-4046) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-270.0.1.el9_8 | [2.34-270.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history:   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-270] - Fix incorrect setting of CXX variable in spec file (RHEL-148252)  [2.34-269] - Fix __nss_get_default_domain logic to restore netgroup user enumeration   (RHEL-168096)  [2.34-268] - resolv: Correctly count records and check hostname validity (RHEL-168851,   RHEL-168852)  [2.34-267] - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules   (RHEL-162901) |
| medium | ELSA-2026-20597 (CVE-2026-4046) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-270.0.1.el9_8 | [2.34-270.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Oracle history:   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-270] - Fix incorrect setting of CXX variable in spec file (RHEL-148252)  [2.34-269] - Fix __nss_get_default_domain logic to restore netgroup user enumeration   (RHEL-168096)  [2.34-268] - resolv: Correctly count records and check hostname validity (RHEL-168851,   RHEL-168852)  [2.34-267] - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules   (RHEL-162901) |
| medium | ELSA-2026-22312 (CVE-2026-28390) | openssl@1:3.0.7-28.0.1.el9_4 | 1:3.5.5-4.0.1.el9_8 | [3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177]  [3.5.5.openela.0.1] - Add OpenELA specific changes  [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves:             RHEL-179274 Resolves:             RHEL-179287 Resolves:             RHEL-179539 Resolves:             RHEL-179544 Resolves:             RHEL-179547 Resolves:             RHEL-179552 Resolves:             RHEL-179556 Resolves:             RHEL-179633 Resolves:             RHEL-179661 Resolves:             RHEL-179678 Resolves:             RHEL-179684 Resolves:             RHEL-179688 Resolves:             RHEL-179691 Resolves:             RHEL-179696 Resolves:             RHEL-179699  [1:3.5.5-3] - Fix CVE-2026-28390   Resolves: RHEL-165870 |
| medium | ELSA-2026-22312 (CVE-2026-28390) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 1:3.5.5-4.0.1.el9_8 | [3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177]  [3.5.5.openela.0.1] - Add OpenELA specific changes  [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves:             RHEL-179274 Resolves:             RHEL-179287 Resolves:             RHEL-179539 Resolves:             RHEL-179544 Resolves:             RHEL-179547 Resolves:             RHEL-179552 Resolves:             RHEL-179556 Resolves:             RHEL-179633 Resolves:             RHEL-179661 Resolves:             RHEL-179678 Resolves:             RHEL-179684 Resolves:             RHEL-179688 Resolves:             RHEL-179691 Resolves:             RHEL-179696 Resolves:             RHEL-179699  [1:3.5.5-3] - Fix CVE-2026-28390   Resolves: RHEL-165870 |
| medium | ELSA-2026-22717 (CVE-2026-35177) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-26.0.1.el9_8.5 | [8.2.2637-26.0.1.el9_8.5] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite   via path traversal bypass  [2:8.2.2637-26.4] - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass  [2:8.2.2637-26.3] - Related: RHEL-159630 rebuild to build with exception target  [2:8.2.2637-26.2] - remove -O0 from flags  [2:8.2.2637-26.1] - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function |
| medium | ELSA-2026-2786 (CVE-2025-15281) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-231.0.1.el9_7.10 | [2.34-231.0.1.10] - Forward-port Oracle patches for ol9-u7   Reviewed-by: [TBD]   Oracle history:   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.2   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-231.10] - Handle FUSE_GETXATTR during FUSE FS mount in tests (RHEL-145151)  [2.34-231.9] - CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-144079)  [2.34-231.8] - Ignore LD_PROFILE in SUID binaries (RHEL-142195)  [2.34-231.7] - Remove default /var/tmp for LD_PROFILE_OUTPUT (RHEL-142195)  [2.34-231.6] - CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141851)  [2.34-231.5] - patch-git: Avoid trailing tabs in changelog (RHEL-141921)  [2.34-231.4] - CVE-2026-0861: Check for alignment overflow in memalign functions   (RHEL-141738)  [2.34-231.3] - patch-git: Add auto-generated/ prefix to Source: files (RHEL-126050)  [2.34-231.2] - patch-git: Import from rhel-9-main and turn on (RHEL-117087) |
| medium | ELSA-2026-2786 (CVE-2025-15281) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-231.0.1.el9_7.10 | [2.34-231.0.1.10] - Forward-port Oracle patches for ol9-u7   Reviewed-by: [TBD]   Oracle history:   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.2   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-231.10] - Handle FUSE_GETXATTR during FUSE FS mount in tests (RHEL-145151)  [2.34-231.9] - CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-144079)  [2.34-231.8] - Ignore LD_PROFILE in SUID binaries (RHEL-142195)  [2.34-231.7] - Remove default /var/tmp for LD_PROFILE_OUTPUT (RHEL-142195)  [2.34-231.6] - CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141851)  [2.34-231.5] - patch-git: Avoid trailing tabs in changelog (RHEL-141921)  [2.34-231.4] - CVE-2026-0861: Check for alignment overflow in memalign functions   (RHEL-141738)  [2.34-231.3] - patch-git: Add auto-generated/ prefix to Source: files (RHEL-126050)  [2.34-231.2] - patch-git: Import from rhel-9-main and turn on (RHEL-117087) |
| medium | ELSA-2026-2786 (CVE-2025-15281) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-231.0.1.el9_7.10 | [2.34-231.0.1.10] - Forward-port Oracle patches for ol9-u7   Reviewed-by: [TBD]   Oracle history:   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.2   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-231.10] - Handle FUSE_GETXATTR during FUSE FS mount in tests (RHEL-145151)  [2.34-231.9] - CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-144079)  [2.34-231.8] - Ignore LD_PROFILE in SUID binaries (RHEL-142195)  [2.34-231.7] - Remove default /var/tmp for LD_PROFILE_OUTPUT (RHEL-142195)  [2.34-231.6] - CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141851)  [2.34-231.5] - patch-git: Avoid trailing tabs in changelog (RHEL-141921)  [2.34-231.4] - CVE-2026-0861: Check for alignment overflow in memalign functions   (RHEL-141738)  [2.34-231.3] - patch-git: Add auto-generated/ prefix to Source: files (RHEL-126050)  [2.34-231.2] - patch-git: Import from rhel-9-main and turn on (RHEL-117087) |
| medium | ELSA-2026-28209 (CVE-2026-41411) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-26.0.1.el9_8.6 | [8.2.2637-26.0.1.el9_8.6] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-26.6] - CVE-2026-41411 vim: Command injection via backticks in tag files  [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite   via path traversal bypass  [2:8.2.2637-26.4] - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass  [2:8.2.2637-26.3] - Related: RHEL-159630 rebuild to build with exception target  [2:8.2.2637-26.2] - remove -O0 from flags  [2:8.2.2637-26.1] - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function |
| medium | ELSA-2026-28911 (CVE-2025-5278) | coreutils@8.32-35.0.1.el9 | 0:8.32-41.0.1.el9_8 | [8.32-41.0.1] - clean up empty file if cp is failed [Orabug 15973168]  [9.5-8] - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) |
| medium | ELSA-2026-28911 (CVE-2025-5278) | coreutils-common@8.32-35.0.1.el9 | 0:8.32-41.0.1.el9_8 | [8.32-41.0.1] - clean up empty file if cp is failed [Orabug 15973168]  [9.5-8] - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331) |
| medium | ELSA-2026-33226 (CVE-2026-5450) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-272.0.1.el9_8 | [2.34-272.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history:   June-5-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-270.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-272] - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710)  [2.34-271] - Fix gconv module reference counter overflow in swscanf and swprintf   families (RHEL-145156) |
| medium | ELSA-2026-33226 (CVE-2026-5450) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-272.0.1.el9_8 | [2.34-272.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history:   June-5-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-270.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-272] - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710)  [2.34-271] - Fix gconv module reference counter overflow in swscanf and swprintf   families (RHEL-145156) |
| medium | ELSA-2026-33226 (CVE-2026-5450) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-272.0.1.el9_8 | [2.34-272.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history:   June-5-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-270.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-272] - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710)  [2.34-271] - Fix gconv module reference counter overflow in swscanf and swprintf   families (RHEL-145156) |
| medium | ELSA-2026-39315 (CVE-2026-48864) | libsolv@0.7.24-2.el9 | 0:0.7.24-6.el9_8 | [0.7.24-6] - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864)   (RHEL-178982) |
| medium | ELSA-2026-4168 (CVE-2025-15366) | python3@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7.1 | [3.9.25-3.0.1.el9_7.1] - Remove upstream URL reference  [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893 |
| medium | ELSA-2026-4168 (CVE-2025-15366) | python3-libs@3.9.18-3.el9_4.5 | 0:3.9.25-3.0.1.el9_7.1 | [3.9.25-3.0.1.el9_7.1] - Remove upstream URL reference  [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893 |
| medium | ELSA-2026-4188 (CVE-2025-14831) | gnutls@3.8.3-4.el9_4 | 0:3.8.3-10.el9_7 | [3.8.3-10] - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831) |
| medium | ELSA-2026-42952 (CVE-2026-5435) | glibc@2.34-100.0.1.el9_4.3 | 0:2.34-274.0.1.el9_8 | [2.34-274.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history:   June-30-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-272.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>     Reviewed-by: David Faust <david.faust@oracle.com>   June-5-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-270.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-274] - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336,   RHEL-185614)  [2.34-273] - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) |
| medium | ELSA-2026-42952 (CVE-2026-5435) | glibc-common@2.34-100.0.1.el9_4.3 | 0:2.34-274.0.1.el9_8 | [2.34-274.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history:   June-30-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-272.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>     Reviewed-by: David Faust <david.faust@oracle.com>   June-5-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-270.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-274] - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336,   RHEL-185614)  [2.34-273] - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) |
| medium | ELSA-2026-42952 (CVE-2026-5435) | glibc-langpack-en@2.34-100.0.1.el9_4.3 | 0:2.34-274.0.1.el9_8 | [2.34-274.0.1] - Forward-port Oracle patches for ol9-u8   Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   Reviewed-by: David Faust <david.faust@oracle.com>   Oracle history:   June-30-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-272.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>     Reviewed-by: David Faust <david.faust@oracle.com>   June-5-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-270.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1   - Forward-port Oracle patches for ol9-u8     Reviewed-by: David Faust <david.faust@oracle.com>   November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1   - Forward-port Oracle patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1   - Forward-port Oralce patches for ol9-u7     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19   - Forward-port Oracle patches for ol9-u6     Reviewed-by: David Faust <david.faust@oracle.com>   May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14   - Forward-port Oracle patches for ol9-u6     Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1   - Forward-port Oracle patches for ol9-u6     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1   - Forward-port Oracle patches for ol9-u6 DP     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1   - Forward-port Oracle patches for ol9-u5     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3   - Forward-port Oracle patches for ol9-u4     Reviewed by: David Faust <david.faust@oracle.com>   May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2   - Forward-port Oracle patches for ol9-u4     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4     Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>   March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1   - Forward-port Oracle patches for ol9-u4-beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7   - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1   - Forward-port Oracle patches for ol9     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2   - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks   - Created tunable glibc.pthread.stack_hugetlb to control when hugepages     can be used for stack allocation.   - In case THP are enabled and glibc.pthread.stack_hugetlb is set to     0, glibc will madvise the kernel not to use allow hugepages for stack     allocations.     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1   - Merge Oracle patches for ol9-u2 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1   - Merge Oracle patches for ol9-u1 beta     Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>   April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1   - Merge Oracle patches with ol9 beta   - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>  [2.34-274] - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336,   RHEL-185614)  [2.34-273] - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) |
| medium | ELSA-2026-49667 (CVE-2026-13757) | p11-kit@0.25.3-2.el9 | 0:0.26.4-1.el9_8 | [0.26.2-1] - Rebase to 0.26.2   Resolves: RHEL-147825  [0.26.1-1] - Rebase to 0.26.1   Resolves: RHEL-139075, RHEL-118361, RHEL-126132  [0.25.10-1] - Update to new upstream release 0.25.10   Resolves: RHEL-115453  [0.25.3-3] - Fix regression in trust where file creation fails for long cert labels   Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command   Resolves: RHEL-31810 |
| medium | ELSA-2026-49667 (CVE-2026-13757) | p11-kit-trust@0.25.3-2.el9 | 0:0.26.4-1.el9_8 | [0.26.2-1] - Rebase to 0.26.2   Resolves: RHEL-147825  [0.26.1-1] - Rebase to 0.26.1   Resolves: RHEL-139075, RHEL-118361, RHEL-126132  [0.25.10-1] - Update to new upstream release 0.25.10   Resolves: RHEL-115453  [0.25.3-3] - Fix regression in trust where file creation fails for long cert labels   Resolves: RHEL-58899 - Fix usage message in p11-kit list-tokens command   Resolves: RHEL-31810 |
| medium | ELSA-2026-500145 (CVE-2026-41989) | libgcrypt@1.10.0-10.el9_2 | 10:1.10.0-13.el9_8_fips | [1.10.0-13_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35961378] - Update FIPS module name for Oracle Linux [Orabug: 35961378]  [1.10.0-13] - Bump version to fix wrong build target.  [1.10.0.12] - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext |
| medium | ELSA-2026-50147-0 (CVE-2026-41989) | libgcrypt@1.10.0-10.el9_2 | 0:1.10.0-13.el9_8 | [1.10.0-13] - Bump version to fix wrong build target.  [1.10.0.12] - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext |
| medium | ELSA-2026-50149 (CVE-2025-14831) | gnutls@3.8.3-4.el9_4 | 10:3.8.3-10.el9_7_fips | [3.8.3-10_fips] - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409]  [3.8.3-10] - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831) |
| medium | ELSA-2026-50345 (CVE-2026-28390) | openssl@1:3.0.7-28.0.1.el9_4 | 10:3.5.5-3.0.1.el9_8_fips | [3.5.5-3.0.1] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.5.5-3] - Fix CVE-2026-28390   Resolves: RHEL-165870  [1:3.5.5-2] - Fix CVE-2026-31790   Resolves: RHEL-161586  [1:3.5.5-1] - Rebase to OpenSSL 3.5.5   Resolves: RHEL-136895   Resolves: RHEL-142004   Resolves: RHEL-142012   Resolves: RHEL-142020   Resolves: RHEL-142024   Resolves: RHEL-142028   Resolves: RHEL-142032   Resolves: RHEL-142036   Resolves: RHEL-142040   Resolves: RHEL-142044   Resolves: RHEL-142048   Resolves: RHEL-142052   Resolves: RHEL-142056 |
| medium | ELSA-2026-50345 (CVE-2026-28390) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 10:3.5.5-3.0.1.el9_8_fips | [3.5.5-3.0.1] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.5.5-3] - Fix CVE-2026-28390   Resolves: RHEL-165870  [1:3.5.5-2] - Fix CVE-2026-31790   Resolves: RHEL-161586  [1:3.5.5-1] - Rebase to OpenSSL 3.5.5   Resolves: RHEL-136895   Resolves: RHEL-142004   Resolves: RHEL-142012   Resolves: RHEL-142020   Resolves: RHEL-142024   Resolves: RHEL-142028   Resolves: RHEL-142032   Resolves: RHEL-142036   Resolves: RHEL-142040   Resolves: RHEL-142044   Resolves: RHEL-142048   Resolves: RHEL-142052   Resolves: RHEL-142056 |
| medium | ELSA-2026-50379 (CVE-2026-34180) | openssl@1:3.0.7-28.0.1.el9_4 | 10:3.5.5-4.0.1.el9_8_fips | [3.5.5-4.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177]  [3.5.5.openela.0.1] - Add OpenELA specific changes  [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves:             RHEL-179274 Resolves:             RHEL-179287 Resolves:             RHEL-179539 Resolves:             RHEL-179544 Resolves:             RHEL-179547 Resolves:             RHEL-179552 Resolves:             RHEL-179556 Resolves:             RHEL-179633 Resolves:             RHEL-179661 Resolves:             RHEL-179678 Resolves:             RHEL-179684 Resolves:             RHEL-179688 Resolves:             RHEL-179691 Resolves:             RHEL-179696 Resolves:             RHEL-179699 |
| medium | ELSA-2026-50379 (CVE-2026-34180) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 10:3.5.5-4.0.1.el9_8_fips | [3.5.5-4.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and   set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177]  [3.5.5.openela.0.1] - Add OpenELA specific changes  [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-34182. Resolves:             RHEL-179274 Resolves:             RHEL-179287 Resolves:             RHEL-179539 Resolves:             RHEL-179544 Resolves:             RHEL-179547 Resolves:             RHEL-179552 Resolves:             RHEL-179556 Resolves:             RHEL-179633 Resolves:             RHEL-179661 Resolves:             RHEL-179678 Resolves:             RHEL-179684 Resolves:             RHEL-179688 Resolves:             RHEL-179691 Resolves:             RHEL-179696 Resolves:             RHEL-179699 |
| medium | ELSA-2026-52674 (CVE-2026-14164) | libarchive@3.5.3-4.el9 | 0:3.5.3-11.el9_8 | [3.5.3-11] - Related: CVE-2026-14164  [3.5.3-10] - Resolves: CVE-2026-14164 |
| medium | ELSA-2026-54662 (CVE-2026-58055) | libnghttp2@1.43.0-5.el9_4.3 | 0:1.43.0-6.el9_8.2 | [1.43.0-6.2] - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) |
| medium | ELSA-2026-55440 (CVE-2026-15588) | glib2@2.68.4-14.el9_4.1 | 0:2.68.4-19.el9_8.9 | [2.68.4-19.9] - Fix CVE-2026-15588: limit D-Bus auth line read length  [2.68.4-19.8] - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157  [2.68.4-19.7] - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - Resolves: RHEL-212217  [2.68.4-19.6] - Fix CVE-2026-58011: range validation in g_date_time_add_full() - Resolves: RHEL-212194  [2.68.4-19.5] - Fix CVE-2026-58013: buffer over-read in GIOChannel with long terminators - Resolves: RHEL-212236  [2.68.4-19.4] - Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list - Resolves: RHEL-190589  [2.68.4-19.3] - Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context - Resolves: RHEL-212261 |
| medium | ELSA-2026-5602 (CVE-2026-25749) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-23.0.1.el9_7.1 | [8.2.2637-23.0.1.el9_7.1] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-23.1] - RHEL-147940 CVE-2026-25749 vim: Heap Overflow in Vim |
| medium | ELSA-2026-60226-0 (CVE-2026-54371) | libattr@2.5.1-3.el9 | 0:2.6.0-1.el9_8 | [2.6.0-1] - rebase to 2.6.0 to fix the following CVEs:   - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186121) |
| low | ELSA-2024-9333 (CVE-2024-4741) | openssl@1:3.0.7-28.0.1.el9_4 | 1:3.2.2-6.0.1.el9_5 | openssl [1:3.2.2-6.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.2.2-6] - rebuilt   Related: RHEL-55339  [1:3.2.2-5] - Fix CVE-2024-6119: Possible denial of service in X.509 name checks   Resolves: RHEL-55339  [1:3.2.2-4] - Fix CVE-2024-5535: SSL_select_next_proto buffer overread   Resolves: RHEL-45657  [1:3.2.2-3] - Replace HKDF backward compatibility patch with the official one   Related: RHEL-40823  [1:3.2.2-2] - Add workaround for EVP_PKEY_CTX_add1_hkdf_info with older providers   Resolves: RHEL-40823  [1:3.2.2-1] - Rebase to OpenSSL 3.2.2. Fixes CVE-2024-2511, CVE-2024-4603, CVE-2024-4741,   and Minerva attack.   Resolves: RHEL-32148   Resolves: RHEL-36792   Resolves: RHEL-38514   Resolves: RHEL-39111  [1:3.2.1-2] - Update RNG changing for FIPS purpose   Resolves: RHEL-35380  [1:3.2.1-1] - Rebasing OpenSSL to 3.2.1   Resolves: RHEL-26271  [1:3.0.7-27] - Use certified FIPS module instead of freshly built one in Red Hat distribution   Related: RHEL-23474  [1:3.0.7-26] - Avoid implicit function declaration when building openssl   Related: RHEL-1780 - In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails   Resolves: RHEL-17104 - Add a directory for OpenSSL providers configuration   Resolves: RHEL-17193 - Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context   Resolves: RHEL-19515 - POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)   Resolves: RHEL-21151 - Excessive time spent checking invalid RSA public keys (CVE-2023-6237)   Resolves: RHEL-21654 - SSL ECDHE Kex fails when pkcs11 engine is set in config file   Resolves: RHEL-20249 - Denial of service via null dereference in PKCS#12   Resolves: RHEL-22486 - Use certified FIPS module instead of freshly built one in Red Hat distribution   Resolves: RHEL-23474  [1:3.0.7-25] - Provide relevant diagnostics when FIPS checksum is corrupted   Resolves: RHEL-5317 - Don't limit using SHA1 in KDFs in non-FIPS mode.   Resolves: RHEL-5295 - Provide empty evp_properties section in main OpenSSL configuration file   Resolves: RHEL-11439 - Avoid implicit function declaration when building openssl   Resolves: RHEL-1780 - Forbid explicit curves when created via EVP_PKEY_fromdata   Resolves: RHEL-5304 - AES-SIV cipher implementation contains a bug that causes it to ignore empty   associated data entries (CVE-2023-2975)   Resolves: RHEL-5302 - Excessive time spent checking DH keys and parameters (CVE-2023-3446)   Resolves: RHEL-5306 - Excessive time spent checking DH q parameter value (CVE-2023-3817)   Resolves: RHEL-5308 - Fix incorrect cipher key and IV length processing (CVE-2023-5363)   Resolves: RHEL-13251 - Switch explicit FIPS indicator for RSA-OAEP to approved following   clarification with CMVP   Resolves: RHEL-14083 - Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)   Resolves: RHEL-14083 - Add missing ECDH Public Key Check in FIPS mode   Resolves: RHEL-15990 - Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)   Resolves: RHEL-15954  [1:3.0.7-24] - Make FIPS module configuration more crypto-policies friendly   Related: rhbz#2216256  [1:3.0.7-23] - Add a workaround for lack of EMS in FIPS mode   Resolves: rhbz#2216256  [1:3.0.7-22] - Remove unsupported curves from nist_curves.   Resolves: rhbz#2069336  [1:3.0.7-21] - Remove the listing of brainpool curves in FIPS mode.   Related: rhbz#2188180  [1:3.0.7-20] - Fix possible DoS translating ASN.1 object identifiers   Resolves: CVE-2023-2650 - Release the DRBG in global default libctx early   Resolves: rhbz#2211340  [1:3.0.7-19] - Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode   Resolves: rhbz#2169757  [1:3.0.7-18] - Use OAEP padding and aes-128-cbc by default in cms command in FIPS mode   Resolves: rhbz#2160797  [1:3.0.7-17] - Enforce using EMS in FIPS mode - better alerts   Related: rhbz#2157951  [1:3.0.7-16] - Upload new upstream sources without manually hobbling them. - Remove the hobbling script as it is redundant. It is now allowed to ship   the sources of patented EC curves, however it is still made unavailable to use   by compiling with the 'no-ec2m' Configure option. The additional forbidden   curves such as P-160, P-192, wap-tls curves are manually removed by updating   0011-Remove-EC-curves.patch. - Enable Brainpool curves. - Apply the changes to ec_curve.c and  ectest.c as a new patch   0010-Add-changes-to-ectest-and-eccurve.patch instead of replacing them. - Modify 0011-Remove-EC-curves.patch to allow Brainpool curves. - Modify 0011-Remove-EC-curves.patch to allow code under macro OPENSSL_NO_EC2M.   Resolves: rhbz#2130618, rhbz#2188180  [1:3.0.7-15] - Backport implicit rejection for RSA PKCS#1 v1.5 encryption   Resolves: rhbz#2153471  [1:3.0.7-14] - Input buffer over-read in AES-XTS implementation on 64 bit ARM   Resolves: rhbz#2188554  [1:3.0.7-13] - Enforce using EMS in FIPS mode   Resolves: rhbz#2157951 - Fix excessive resource usage in verifying X509 policy constraints   Resolves: rhbz#2186661 - Fix invalid certificate policies in leaf certificates check   Resolves: rhbz#2187429 - Certificate policy check not enabled   Resolves: rhbz#2187431 - OpenSSL rsa_verify_recover key length checks in FIPS mode   Resolves: rhbz#2186819  [1:3.0.7-12] - Change explicit FIPS indicator for RSA decryption to unapproved   Resolves: rhbz#2179379  [1:3.0.7-11] - Add missing reference to patchfile to add explicit FIPS indicator to RSA   encryption and RSASVE and fix the gettable parameter list for the RSA   asymmetric cipher implementation.   Resolves: rhbz#2179379  [1:3.0.7-10] - Add explicit FIPS indicator to RSA encryption and RSASVE   Resolves: rhbz#2179379  [1:3.0.7-9] - Fix explicit FIPS indicator for X9.42 KDF when used with output lengths < 14 bytes   Resolves: rhbz#2175864  [1:3.0.7-8] - Fix Wpointer-sign compiler warning   Resolves: rhbz#2178034  [1:3.0.7-7] - Add explicit FIPS indicators to key derivation functions   Resolves: rhbz#2175860 rhbz#2175864 - Zeroize FIPS module integrity check MAC after check   Resolves: rhbz#2175873 - Add explicit FIPS indicator for IV generation in AES-GCM   Resolves: rhbz#2175868 - Add explicit FIPS indicator for PBKDF2, use test vector with FIPS-compliant   salt in PBKDF2 FIPS self-test   Resolves: rhbz#2178137 - Limit RSA_NO_PADDING for encryption and signature in FIPS mode   Resolves: rhbz#2178029 - Pairwise consistency tests should use Digest+Sign/Verify   Resolves: rhbz#2178034 - Forbid DHX keys import in FIPS mode   Resolves: rhbz#2178030 - DH PCT should abort on failure   Resolves: rhbz#2178039 - Increase RNG seeding buffer size to 32   Related: rhbz#2168224  [1:3.0.7-6] - Fixes RNG slowdown in FIPS mode   Resolves: rhbz#2168224  [1:3.0.7-5] - Fixed X.509 Name Constraints Read Buffer Overflow   Resolves: CVE-2022-4203 - Fixed Timing Oracle in RSA Decryption   Resolves: CVE-2022-4304 - Fixed Double free after calling PEM_read_bio_ex   Resolves: CVE-2022-4450 - Fixed Use-after-free following BIO_new_NDEF   Resolves: CVE-2023-0215 - Fixed Invalid pointer dereference in d2i_PKCS7 functions   Resolves: CVE-2023-0216 - Fixed NULL dereference validating DSA public key   Resolves: CVE-2023-0217 - Fixed X.400 address type confusion in X.509 GeneralName   Resolves: CVE-2023-0286 - Fixed NULL dereference during PKCS7 data verification   Resolves: CVE-2023-0401  [1:3.0.7-4] - Disallow SHAKE in RSA-OAEP decryption in FIPS mode   Resolves: rhbz#2142121  [1:3.0.7-3] - Refactor OpenSSL fips module MAC verification   Resolves: rhbz#2157965  [1:3.0.7-2] - Various provider-related imrovements necessary for PKCS#11 provider correct operations   Resolves: rhbz#2142517 - We should export 2 versions of OPENSSL_str[n]casecmp to be compatible with upstream   Resolves: rhbz#2133809 - Removed recommended package for openssl-libs   Resolves: rhbz#2093804 - Adjusting include for the FIPS_mode macro   Resolves: rhbz#2083879 - Backport of ppc64le Montgomery multiply enhancement   Resolves: rhbz#2130708 - Fix explicit indicator for PSS salt length in FIPS mode when used with   negative magic values   Resolves: rhbz#2142087 - Update change to default PSS salt length with patch state from upstream   Related: rhbz#2142087  [1:3.0.7-1] - Rebasing to OpenSSL 3.0.7   Resolves: rhbz#2129063  [1:3.0.1-44] - SHAKE-128/256 are not allowed with RSA in FIPS mode   Resolves: rhbz#2144010 - Avoid memory leaks in TLS   Resolves: rhbz#2144008 - FIPS RSA CRT tests must use correct parameters   Resolves: rhbz#2144006 - FIPS-140-3 permits only SHA1, SHA256, and SHA512 for DRBG-HASH/DRBG-HMAC   Resolves: rhbz#2144017 - Remove support for X9.31 signature padding in FIPS mode   Resolves: rhbz#2144015 - Add explicit indicator for SP 800-108 KDFs with short key lengths   Resolves: rhbz#2144019 - Add explicit indicator for HMAC with short key lengths   Resolves: rhbz#2144000 - Set minimum password length for PBKDF2 in FIPS mode   Resolves: rhbz#2144003 - Add explicit indicator for PSS salt length in FIPS mode   Resolves: rhbz#2144012 - Clamp default PSS salt length to digest size for FIPS 186-4 compliance   Related: rhbz#2144012 - Forbid short RSA keys for key encapsulation/decapsulation in FIPS mode   Resolves: rhbz#2145170  [1:3.0.1-43] - CVE-2022-3602: X.509 Email Address Buffer Overflow - CVE-2022-3786: X.509 Email Address Buffer Overflow   Resolves: CVE-2022-3602  openssl-fips-provider [3.0.7-6.0.1] - Drop OpenELA branding [Orabug: 37274593] - Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 37274593] - Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 37274593]  [3.0.7.openela.0.1] - Add OpenELA specific changes  [3.0.7-6] - Try to fix an upgrade issue with pkg version numbers   Resolves: RHEL-58662  [3.0.7-5] - Add an empty metapackage and proper requires to correctly   handle upgrades.   Related: RHEL-32123  [3.0.7-4] - Change subpackage names to avoid build gating issues   Related: RHEL-32123  [3.0.7-3] - Change tarball source contents - Rework file extraction process - Fixes debug packages   Resolves: RHEL-32123 |
| low | ELSA-2024-9333 (CVE-2024-4741) | openssl-fips-provider@3.0.7-2.0.1.el9 | 0:3.0.7-6.0.1.el9_5 | openssl [1:3.2.2-6.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.2.2-6] - rebuilt   Related: RHEL-55339  [1:3.2.2-5] - Fix CVE-2024-6119: Possible denial of service in X.509 name checks   Resolves: RHEL-55339  [1:3.2.2-4] - Fix CVE-2024-5535: SSL_select_next_proto buffer overread   Resolves: RHEL-45657  [1:3.2.2-3] - Replace HKDF backward compatibility patch with the official one   Related: RHEL-40823  [1:3.2.2-2] - Add workaround for EVP_PKEY_CTX_add1_hkdf_info with older providers   Resolves: RHEL-40823  [1:3.2.2-1] - Rebase to OpenSSL 3.2.2. Fixes CVE-2024-2511, CVE-2024-4603, CVE-2024-4741,   and Minerva attack.   Resolves: RHEL-32148   Resolves: RHEL-36792   Resolves: RHEL-38514   Resolves: RHEL-39111  [1:3.2.1-2] - Update RNG changing for FIPS purpose   Resolves: RHEL-35380  [1:3.2.1-1] - Rebasing OpenSSL to 3.2.1   Resolves: RHEL-26271  [1:3.0.7-27] - Use certified FIPS module instead of freshly built one in Red Hat distribution   Related: RHEL-23474  [1:3.0.7-26] - Avoid implicit function declaration when building openssl   Related: RHEL-1780 - In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails   Resolves: RHEL-17104 - Add a directory for OpenSSL providers configuration   Resolves: RHEL-17193 - Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context   Resolves: RHEL-19515 - POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)   Resolves: RHEL-21151 - Excessive time spent checking invalid RSA public keys (CVE-2023-6237)   Resolves: RHEL-21654 - SSL ECDHE Kex fails when pkcs11 engine is set in config file   Resolves: RHEL-20249 - Denial of service via null dereference in PKCS#12   Resolves: RHEL-22486 - Use certified FIPS module instead of freshly built one in Red Hat distribution   Resolves: RHEL-23474  [1:3.0.7-25] - Provide relevant diagnostics when FIPS checksum is corrupted   Resolves: RHEL-5317 - Don't limit using SHA1 in KDFs in non-FIPS mode.   Resolves: RHEL-5295 - Provide empty evp_properties section in main OpenSSL configuration file   Resolves: RHEL-11439 - Avoid implicit function declaration when building openssl   Resolves: RHEL-1780 - Forbid explicit curves when created via EVP_PKEY_fromdata   Resolves: RHEL-5304 - AES-SIV cipher implementation contains a bug that causes it to ignore empty   associated data entries (CVE-2023-2975)   Resolves: RHEL-5302 - Excessive time spent checking DH keys and parameters (CVE-2023-3446)   Resolves: RHEL-5306 - Excessive time spent checking DH q parameter value (CVE-2023-3817)   Resolves: RHEL-5308 - Fix incorrect cipher key and IV length processing (CVE-2023-5363)   Resolves: RHEL-13251 - Switch explicit FIPS indicator for RSA-OAEP to approved following   clarification with CMVP   Resolves: RHEL-14083 - Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)   Resolves: RHEL-14083 - Add missing ECDH Public Key Check in FIPS mode   Resolves: RHEL-15990 - Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)   Resolves: RHEL-15954  [1:3.0.7-24] - Make FIPS module configuration more crypto-policies friendly   Related: rhbz#2216256  [1:3.0.7-23] - Add a workaround for lack of EMS in FIPS mode   Resolves: rhbz#2216256  [1:3.0.7-22] - Remove unsupported curves from nist_curves.   Resolves: rhbz#2069336  [1:3.0.7-21] - Remove the listing of brainpool curves in FIPS mode.   Related: rhbz#2188180  [1:3.0.7-20] - Fix possible DoS translating ASN.1 object identifiers   Resolves: CVE-2023-2650 - Release the DRBG in global default libctx early   Resolves: rhbz#2211340  [1:3.0.7-19] - Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode   Resolves: rhbz#2169757  [1:3.0.7-18] - Use OAEP padding and aes-128-cbc by default in cms command in FIPS mode   Resolves: rhbz#2160797  [1:3.0.7-17] - Enforce using EMS in FIPS mode - better alerts   Related: rhbz#2157951  [1:3.0.7-16] - Upload new upstream sources without manually hobbling them. - Remove the hobbling script as it is redundant. It is now allowed to ship   the sources of patented EC curves, however it is still made unavailable to use   by compiling with the 'no-ec2m' Configure option. The additional forbidden   curves such as P-160, P-192, wap-tls curves are manually removed by updating   0011-Remove-EC-curves.patch. - Enable Brainpool curves. - Apply the changes to ec_curve.c and  ectest.c as a new patch   0010-Add-changes-to-ectest-and-eccurve.patch instead of replacing them. - Modify 0011-Remove-EC-curves.patch to allow Brainpool curves. - Modify 0011-Remove-EC-curves.patch to allow code under macro OPENSSL_NO_EC2M.   Resolves: rhbz#2130618, rhbz#2188180  [1:3.0.7-15] - Backport implicit rejection for RSA PKCS#1 v1.5 encryption   Resolves: rhbz#2153471  [1:3.0.7-14] - Input buffer over-read in AES-XTS implementation on 64 bit ARM   Resolves: rhbz#2188554  [1:3.0.7-13] - Enforce using EMS in FIPS mode   Resolves: rhbz#2157951 - Fix excessive resource usage in verifying X509 policy constraints   Resolves: rhbz#2186661 - Fix invalid certificate policies in leaf certificates check   Resolves: rhbz#2187429 - Certificate policy check not enabled   Resolves: rhbz#2187431 - OpenSSL rsa_verify_recover key length checks in FIPS mode   Resolves: rhbz#2186819  [1:3.0.7-12] - Change explicit FIPS indicator for RSA decryption to unapproved   Resolves: rhbz#2179379  [1:3.0.7-11] - Add missing reference to patchfile to add explicit FIPS indicator to RSA   encryption and RSASVE and fix the gettable parameter list for the RSA   asymmetric cipher implementation.   Resolves: rhbz#2179379  [1:3.0.7-10] - Add explicit FIPS indicator to RSA encryption and RSASVE   Resolves: rhbz#2179379  [1:3.0.7-9] - Fix explicit FIPS indicator for X9.42 KDF when used with output lengths < 14 bytes   Resolves: rhbz#2175864  [1:3.0.7-8] - Fix Wpointer-sign compiler warning   Resolves: rhbz#2178034  [1:3.0.7-7] - Add explicit FIPS indicators to key derivation functions   Resolves: rhbz#2175860 rhbz#2175864 - Zeroize FIPS module integrity check MAC after check   Resolves: rhbz#2175873 - Add explicit FIPS indicator for IV generation in AES-GCM   Resolves: rhbz#2175868 - Add explicit FIPS indicator for PBKDF2, use test vector with FIPS-compliant   salt in PBKDF2 FIPS self-test   Resolves: rhbz#2178137 - Limit RSA_NO_PADDING for encryption and signature in FIPS mode   Resolves: rhbz#2178029 - Pairwise consistency tests should use Digest+Sign/Verify   Resolves: rhbz#2178034 - Forbid DHX keys import in FIPS mode   Resolves: rhbz#2178030 - DH PCT should abort on failure   Resolves: rhbz#2178039 - Increase RNG seeding buffer size to 32   Related: rhbz#2168224  [1:3.0.7-6] - Fixes RNG slowdown in FIPS mode   Resolves: rhbz#2168224  [1:3.0.7-5] - Fixed X.509 Name Constraints Read Buffer Overflow   Resolves: CVE-2022-4203 - Fixed Timing Oracle in RSA Decryption   Resolves: CVE-2022-4304 - Fixed Double free after calling PEM_read_bio_ex   Resolves: CVE-2022-4450 - Fixed Use-after-free following BIO_new_NDEF   Resolves: CVE-2023-0215 - Fixed Invalid pointer dereference in d2i_PKCS7 functions   Resolves: CVE-2023-0216 - Fixed NULL dereference validating DSA public key   Resolves: CVE-2023-0217 - Fixed X.400 address type confusion in X.509 GeneralName   Resolves: CVE-2023-0286 - Fixed NULL dereference during PKCS7 data verification   Resolves: CVE-2023-0401  [1:3.0.7-4] - Disallow SHAKE in RSA-OAEP decryption in FIPS mode   Resolves: rhbz#2142121  [1:3.0.7-3] - Refactor OpenSSL fips module MAC verification   Resolves: rhbz#2157965  [1:3.0.7-2] - Various provider-related imrovements necessary for PKCS#11 provider correct operations   Resolves: rhbz#2142517 - We should export 2 versions of OPENSSL_str[n]casecmp to be compatible with upstream   Resolves: rhbz#2133809 - Removed recommended package for openssl-libs   Resolves: rhbz#2093804 - Adjusting include for the FIPS_mode macro   Resolves: rhbz#2083879 - Backport of ppc64le Montgomery multiply enhancement   Resolves: rhbz#2130708 - Fix explicit indicator for PSS salt length in FIPS mode when used with   negative magic values   Resolves: rhbz#2142087 - Update change to default PSS salt length with patch state from upstream   Related: rhbz#2142087  [1:3.0.7-1] - Rebasing to OpenSSL 3.0.7   Resolves: rhbz#2129063  [1:3.0.1-44] - SHAKE-128/256 are not allowed with RSA in FIPS mode   Resolves: rhbz#2144010 - Avoid memory leaks in TLS   Resolves: rhbz#2144008 - FIPS RSA CRT tests must use correct parameters   Resolves: rhbz#2144006 - FIPS-140-3 permits only SHA1, SHA256, and SHA512 for DRBG-HASH/DRBG-HMAC   Resolves: rhbz#2144017 - Remove support for X9.31 signature padding in FIPS mode   Resolves: rhbz#2144015 - Add explicit indicator for SP 800-108 KDFs with short key lengths   Resolves: rhbz#2144019 - Add explicit indicator for HMAC with short key lengths   Resolves: rhbz#2144000 - Set minimum password length for PBKDF2 in FIPS mode   Resolves: rhbz#2144003 - Add explicit indicator for PSS salt length in FIPS mode   Resolves: rhbz#2144012 - Clamp default PSS salt length to digest size for FIPS 186-4 compliance   Related: rhbz#2144012 - Forbid short RSA keys for key encapsulation/decapsulation in FIPS mode   Resolves: rhbz#2145170  [1:3.0.1-43] - CVE-2022-3602: X.509 Email Address Buffer Overflow - CVE-2022-3786: X.509 Email Address Buffer Overflow   Resolves: CVE-2022-3602  openssl-fips-provider [3.0.7-6.0.1] - Drop OpenELA branding [Orabug: 37274593] - Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 37274593] - Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 37274593]  [3.0.7.openela.0.1] - Add OpenELA specific changes  [3.0.7-6] - Try to fix an upgrade issue with pkg version numbers   Resolves: RHEL-58662  [3.0.7-5] - Add an empty metapackage and proper requires to correctly   handle upgrades.   Related: RHEL-32123  [3.0.7-4] - Change subpackage names to avoid build gating issues   Related: RHEL-32123  [3.0.7-3] - Change tarball source contents - Rework file extraction process - Fixes debug packages   Resolves: RHEL-32123 |
| low | ELSA-2024-9333 (CVE-2024-2511) | openssl-libs@1:3.0.7-28.0.1.el9_4 | 1:3.2.2-6.0.1.el9_5 | openssl [1:3.2.2-6.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177]  [1:3.2.2-6] - rebuilt   Related: RHEL-55339  [1:3.2.2-5] - Fix CVE-2024-6119: Possible denial of service in X.509 name checks   Resolves: RHEL-55339  [1:3.2.2-4] - Fix CVE-2024-5535: SSL_select_next_proto buffer overread   Resolves: RHEL-45657  [1:3.2.2-3] - Replace HKDF backward compatibility patch with the official one   Related: RHEL-40823  [1:3.2.2-2] - Add workaround for EVP_PKEY_CTX_add1_hkdf_info with older providers   Resolves: RHEL-40823  [1:3.2.2-1] - Rebase to OpenSSL 3.2.2. Fixes CVE-2024-2511, CVE-2024-4603, CVE-2024-4741,   and Minerva attack.   Resolves: RHEL-32148   Resolves: RHEL-36792   Resolves: RHEL-38514   Resolves: RHEL-39111  [1:3.2.1-2] - Update RNG changing for FIPS purpose   Resolves: RHEL-35380  [1:3.2.1-1] - Rebasing OpenSSL to 3.2.1   Resolves: RHEL-26271  [1:3.0.7-27] - Use certified FIPS module instead of freshly built one in Red Hat distribution   Related: RHEL-23474  [1:3.0.7-26] - Avoid implicit function declaration when building openssl   Related: RHEL-1780 - In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails   Resolves: RHEL-17104 - Add a directory for OpenSSL providers configuration   Resolves: RHEL-17193 - Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context   Resolves: RHEL-19515 - POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)   Resolves: RHEL-21151 - Excessive time spent checking invalid RSA public keys (CVE-2023-6237)   Resolves: RHEL-21654 - SSL ECDHE Kex fails when pkcs11 engine is set in config file   Resolves: RHEL-20249 - Denial of service via null dereference in PKCS#12   Resolves: RHEL-22486 - Use certified FIPS module instead of freshly built one in Red Hat distribution   Resolves: RHEL-23474  [1:3.0.7-25] - Provide relevant diagnostics when FIPS checksum is corrupted   Resolves: RHEL-5317 - Don't limit using SHA1 in KDFs in non-FIPS mode.   Resolves: RHEL-5295 - Provide empty evp_properties section in main OpenSSL configuration file   Resolves: RHEL-11439 - Avoid implicit function declaration when building openssl   Resolves: RHEL-1780 - Forbid explicit curves when created via EVP_PKEY_fromdata   Resolves: RHEL-5304 - AES-SIV cipher implementation contains a bug that causes it to ignore empty   associated data entries (CVE-2023-2975)   Resolves: RHEL-5302 - Excessive time spent checking DH keys and parameters (CVE-2023-3446)   Resolves: RHEL-5306 - Excessive time spent checking DH q parameter value (CVE-2023-3817)   Resolves: RHEL-5308 - Fix incorrect cipher key and IV length processing (CVE-2023-5363)   Resolves: RHEL-13251 - Switch explicit FIPS indicator for RSA-OAEP to approved following   clarification with CMVP   Resolves: RHEL-14083 - Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)   Resolves: RHEL-14083 - Add missing ECDH Public Key Check in FIPS mode   Resolves: RHEL-15990 - Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)   Resolves: RHEL-15954  [1:3.0.7-24] - Make FIPS module configuration more crypto-policies friendly   Related: rhbz#2216256  [1:3.0.7-23] - Add a workaround for lack of EMS in FIPS mode   Resolves: rhbz#2216256  [1:3.0.7-22] - Remove unsupported curves from nist_curves.   Resolves: rhbz#2069336  [1:3.0.7-21] - Remove the listing of brainpool curves in FIPS mode.   Related: rhbz#2188180  [1:3.0.7-20] - Fix possible DoS translating ASN.1 object identifiers   Resolves: CVE-2023-2650 - Release the DRBG in global default libctx early   Resolves: rhbz#2211340  [1:3.0.7-19] - Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode   Resolves: rhbz#2169757  [1:3.0.7-18] - Use OAEP padding and aes-128-cbc by default in cms command in FIPS mode   Resolves: rhbz#2160797  [1:3.0.7-17] - Enforce using EMS in FIPS mode - better alerts   Related: rhbz#2157951  [1:3.0.7-16] - Upload new upstream sources without manually hobbling them. - Remove the hobbling script as it is redundant. It is now allowed to ship   the sources of patented EC curves, however it is still made unavailable to use   by compiling with the 'no-ec2m' Configure option. The additional forbidden   curves such as P-160, P-192, wap-tls curves are manually removed by updating   0011-Remove-EC-curves.patch. - Enable Brainpool curves. - Apply the changes to ec_curve.c and  ectest.c as a new patch   0010-Add-changes-to-ectest-and-eccurve.patch instead of replacing them. - Modify 0011-Remove-EC-curves.patch to allow Brainpool curves. - Modify 0011-Remove-EC-curves.patch to allow code under macro OPENSSL_NO_EC2M.   Resolves: rhbz#2130618, rhbz#2188180  [1:3.0.7-15] - Backport implicit rejection for RSA PKCS#1 v1.5 encryption   Resolves: rhbz#2153471  [1:3.0.7-14] - Input buffer over-read in AES-XTS implementation on 64 bit ARM   Resolves: rhbz#2188554  [1:3.0.7-13] - Enforce using EMS in FIPS mode   Resolves: rhbz#2157951 - Fix excessive resource usage in verifying X509 policy constraints   Resolves: rhbz#2186661 - Fix invalid certificate policies in leaf certificates check   Resolves: rhbz#2187429 - Certificate policy check not enabled   Resolves: rhbz#2187431 - OpenSSL rsa_verify_recover key length checks in FIPS mode   Resolves: rhbz#2186819  [1:3.0.7-12] - Change explicit FIPS indicator for RSA decryption to unapproved   Resolves: rhbz#2179379  [1:3.0.7-11] - Add missing reference to patchfile to add explicit FIPS indicator to RSA   encryption and RSASVE and fix the gettable parameter list for the RSA   asymmetric cipher implementation.   Resolves: rhbz#2179379  [1:3.0.7-10] - Add explicit FIPS indicator to RSA encryption and RSASVE   Resolves: rhbz#2179379  [1:3.0.7-9] - Fix explicit FIPS indicator for X9.42 KDF when used with output lengths < 14 bytes   Resolves: rhbz#2175864  [1:3.0.7-8] - Fix Wpointer-sign compiler warning   Resolves: rhbz#2178034  [1:3.0.7-7] - Add explicit FIPS indicators to key derivation functions   Resolves: rhbz#2175860 rhbz#2175864 - Zeroize FIPS module integrity check MAC after check   Resolves: rhbz#2175873 - Add explicit FIPS indicator for IV generation in AES-GCM   Resolves: rhbz#2175868 - Add explicit FIPS indicator for PBKDF2, use test vector with FIPS-compliant   salt in PBKDF2 FIPS self-test   Resolves: rhbz#2178137 - Limit RSA_NO_PADDING for encryption and signature in FIPS mode   Resolves: rhbz#2178029 - Pairwise consistency tests should use Digest+Sign/Verify   Resolves: rhbz#2178034 - Forbid DHX keys import in FIPS mode   Resolves: rhbz#2178030 - DH PCT should abort on failure   Resolves: rhbz#2178039 - Increase RNG seeding buffer size to 32   Related: rhbz#2168224  [1:3.0.7-6] - Fixes RNG slowdown in FIPS mode   Resolves: rhbz#2168224  [1:3.0.7-5] - Fixed X.509 Name Constraints Read Buffer Overflow   Resolves: CVE-2022-4203 - Fixed Timing Oracle in RSA Decryption   Resolves: CVE-2022-4304 - Fixed Double free after calling PEM_read_bio_ex   Resolves: CVE-2022-4450 - Fixed Use-after-free following BIO_new_NDEF   Resolves: CVE-2023-0215 - Fixed Invalid pointer dereference in d2i_PKCS7 functions   Resolves: CVE-2023-0216 - Fixed NULL dereference validating DSA public key   Resolves: CVE-2023-0217 - Fixed X.400 address type confusion in X.509 GeneralName   Resolves: CVE-2023-0286 - Fixed NULL dereference during PKCS7 data verification   Resolves: CVE-2023-0401  [1:3.0.7-4] - Disallow SHAKE in RSA-OAEP decryption in FIPS mode   Resolves: rhbz#2142121  [1:3.0.7-3] - Refactor OpenSSL fips module MAC verification   Resolves: rhbz#2157965  [1:3.0.7-2] - Various provider-related imrovements necessary for PKCS#11 provider correct operations   Resolves: rhbz#2142517 - We should export 2 versions of OPENSSL_str[n]casecmp to be compatible with upstream   Resolves: rhbz#2133809 - Removed recommended package for openssl-libs   Resolves: rhbz#2093804 - Adjusting include for the FIPS_mode macro   Resolves: rhbz#2083879 - Backport of ppc64le Montgomery multiply enhancement   Resolves: rhbz#2130708 - Fix explicit indicator for PSS salt length in FIPS mode when used with   negative magic values   Resolves: rhbz#2142087 - Update change to default PSS salt length with patch state from upstream   Related: rhbz#2142087  [1:3.0.7-1] - Rebasing to OpenSSL 3.0.7   Resolves: rhbz#2129063  [1:3.0.1-44] - SHAKE-128/256 are not allowed with RSA in FIPS mode   Resolves: rhbz#2144010 - Avoid memory leaks in TLS   Resolves: rhbz#2144008 - FIPS RSA CRT tests must use correct parameters   Resolves: rhbz#2144006 - FIPS-140-3 permits only SHA1, SHA256, and SHA512 for DRBG-HASH/DRBG-HMAC   Resolves: rhbz#2144017 - Remove support for X9.31 signature padding in FIPS mode   Resolves: rhbz#2144015 - Add explicit indicator for SP 800-108 KDFs with short key lengths   Resolves: rhbz#2144019 - Add explicit indicator for HMAC with short key lengths   Resolves: rhbz#2144000 - Set minimum password length for PBKDF2 in FIPS mode   Resolves: rhbz#2144003 - Add explicit indicator for PSS salt length in FIPS mode   Resolves: rhbz#2144012 - Clamp default PSS salt length to digest size for FIPS 186-4 compliance   Related: rhbz#2144012 - Forbid short RSA keys for key encapsulation/decapsulation in FIPS mode   Resolves: rhbz#2145170  [1:3.0.1-43] - CVE-2022-3602: X.509 Email Address Buffer Overflow - CVE-2022-3786: X.509 Email Address Buffer Overflow   Resolves: CVE-2022-3602  openssl-fips-provider [3.0.7-6.0.1] - Drop OpenELA branding [Orabug: 37274593] - Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 37274593] - Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 37274593]  [3.0.7.openela.0.1] - Add OpenELA specific changes  [3.0.7-6] - Try to fix an upgrade issue with pkg version numbers   Resolves: RHEL-58662  [3.0.7-5] - Add an empty metapackage and proper requires to correctly   handle upgrades.   Related: RHEL-32123  [3.0.7-4] - Change subpackage names to avoid build gating issues   Related: RHEL-32123  [3.0.7-3] - Change tarball source contents - Rework file extraction process - Fixes debug packages   Resolves: RHEL-32123 |
| low | ELSA-2024-9405 (CVE-2021-3903) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-21.0.1.el9 | [8.2.2637-21.0.1] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-21] - RHEL-40602 CVE-2021-3903 vim: heap-based buffer overflow vulnerability |
| low | ELSA-2025-12876 (CVE-2022-29458) | ncurses-base@6.2-10.20210508.el9 | 0:6.2-10.20210508.el9_6.2 | [6.2-10.20210508.el9_6.2] - remove execute permissions from ANNOUNCE file (RHEL-102738)  [6.2-10.20210508.el9_6.1] - guard against corrupt terminfo data in string conversion (CVE-2022-29458   RHEL-100139) |
| low | ELSA-2025-12876 (CVE-2022-29458) | ncurses-libs@6.2-10.20210508.el9 | 0:6.2-10.20210508.el9_6.2 | [6.2-10.20210508.el9_6.2] - remove execute permissions from ANNOUNCE file (RHEL-102738)  [6.2-10.20210508.el9_6.1] - guard against corrupt terminfo data in string conversion (CVE-2022-29458   RHEL-100139) |
| low | ELSA-2025-20559-0 (CVE-2024-56433) | shadow-utils@2:4.9-8.el9 | 2:4.9-15.el9 | [2:4.9-15] - nss.c: shadow_logfd to stderr. Resolves: RHEL-83431 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940 |
| low | ELSA-2025-7440 (CVE-2023-4752) | vim-minimal@2:8.2.2637-20.0.1.el9_1 | 2:8.2.2637-22.0.1.el9_6 | [8.2.2637-22.0.1] - Remove upstream references [Orabug: 31197557]  [2:8.2.2637-22] - RHEL-2159 vim: Heap Use After Free in function ins_compl_get_exp in vim/vim |
| low | ELSA-2026-28253 (CVE-2025-13151) | libtasn1@4.16.0-8.el9_1 | 0:4.16.0-10.el9_8 | [4.16.0-10] - Backport the fix for CVE-2025-13151 (RHEL-139568) |
| low | ELSA-2026-28254 (CVE-2024-34459) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-14.el9_8.1 | [2.9.13-14.1] - Fix CVE-2024-34459 (RHEL-177882) |
| low | ELSA-2026-39317 (CVE-2025-6170) | libxml2@2.9.13-6.el9_4 | 0:2.9.13-14.el9_8.2 | [2.9.13-14.2] - Fix CVE-2025-6170 (RHEL-182016) |

## Findings from bomdrift

| Severity | Vulnerability | Package | Fixed in | Description |
| --- | --- | --- | --- | --- |
| high | bomdrift.deprecated | pkg:pypi/dbus-python@1.2.18 | — | `dbus-python` is deprecated upstream: PyPI classifier: Development Status :: 7 - Inactive |

## Licence & provenance from provenant

| Kind | Value | SPDX | File | Confidence |
| --- | --- | --- | --- | --- |
| license | Apache-2.0 | Apache-2.0 | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-only WITH Classpath-exception-2.0 | GPL-2.0-only WITH Classpath-exception-2.0 | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-only WITH Classpath-exception-2.0 | GPL-2.0-only WITH Classpath-exception-2.0 | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-only WITH Classpath-exception-2.0 | GPL-2.0-only WITH Classpath-exception-2.0 | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-only WITH Classpath-exception-2.0 | GPL-2.0-only WITH Classpath-exception-2.0 | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-only WITH Classpath-exception-2.0 | GPL-2.0-only WITH Classpath-exception-2.0 | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later | GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND GPL-2.0-only | GPL-2.0-or-later AND GPL-2.0-only | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND GPL-2.0-only | GPL-2.0-or-later AND GPL-2.0-only | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND LGPL-2.0-or-later | GPL-2.0-or-later AND LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND LGPL-3.0-or-later | GPL-2.0-or-later AND LGPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND LGPL-3.0-or-later | GPL-2.0-or-later AND LGPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND LGPL-3.0-or-later | GPL-2.0-or-later AND LGPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND LGPL-3.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later | GPL-2.0-or-later AND LGPL-3.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-2.0-or-later AND NIST-PD | GPL-2.0-or-later AND NIST-PD | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later | GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later | GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later | GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later | GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | GPL-3.0-or-later AND LGPL-2.0-or-later | GPL-3.0-or-later AND LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-only | LGPL-2.0-only | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-only | LGPL-2.0-only | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later | LGPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later AND GPL-2.0-or-later | LGPL-2.0-or-later AND GPL-2.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later AND GPL-2.0-or-later AND LGPL-3.0-or-later | LGPL-2.0-or-later AND GPL-2.0-or-later AND LGPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later AND GPL-3.0-or-later | LGPL-2.0-or-later AND GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later AND GPL-3.0-or-later | LGPL-2.0-or-later AND GPL-3.0-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LGPL-2.0-or-later AND LGPL-2.1-or-later | LGPL-2.0-or-later AND LGPL-2.1-or-later | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | MIT | MIT | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LicenseRef-scancode-unknown-license-reference AND LicenseRef-scancode-public-domain | LicenseRef-scancode-unknown-license-reference AND LicenseRef-scancode-public-domain | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |
| license | LicenseRef-scancode-unknown-license-reference AND LicenseRef-scancode-public-domain | LicenseRef-scancode-unknown-license-reference AND LicenseRef-scancode-public-domain | /tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json | 100% |

## Skipped or failed analyzers

- **shieldbom** (fail): Parsed 192 components from "/tmp/sba-analyze-108961-1239-1788288347918010405-1/input.cdx.json" (CycloneDX 1.5 (JSON)) Found 0 vulnerabilities Found 152 license issues  DISCLAIMER: This report is provided "AS IS" without warranty of any kind. Vulnerability results are based on publicly available data sources (e.g., OSV.dev, NVD) which may be incomplete or delayed. The absence of reported vulnerabilities does not guarantee that the software is free of security issues. This tool assists with security analysis but does not constitute a complete security assessment, legal advice, or certification of regulatory compliance (including EU CRA conformity). Users are solely responsible for their own compliance determinations. Always perform additional security assessments as appropriate.