Red Hat Security Advisory

RHSA-2025:21818

idm:DL1 security update

Released 2025-11-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.8.8) bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.x86_64::idm:DL1 +47
Red Hat Enterprise Linux AppStream TUS (v.8.8) bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39

Fixes 2 records

TI-2025-36703 CVE-2025-59088 · GHSA-crfg-8xhr-7q4w

Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

MEDIUM 44

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00491 Published 2025-11-12 Fixed in 1.1.0, 1.0.0-19.el10_1 +13 CWE-918

TI-2025-36704 CVE-2025-59089 · GHSA-hxcg-77v3-qx52

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

LOW 27

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0056 Published 2025-11-12 Fixed in 1.1.0, 1.0.0-19.el10_1 +13 CWE-770