Red Hat Security Advisory

RHSA-2025:7592

yggdrasil security update

Released 2025-05-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) yggdrasil-0.4.5-3.el10_0
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) yggdrasil-devel-0.4.5-3.el10_0

Fixes 2 records

TI-2025-03476 CVE-2025-3931 · GHSA-rpg2-jvhp-h354

Yggdrasil: local privilege escalation in yggdrasil

LOW 35

A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00181 Published 2025-05-14 Fixed in 0.4.7, 0.4.5-3.el10_0 CWE-280

TI-2024-30406 CVE-2024-45336 · GHSA-7wrw-r4p8-38rx

Sensitive headers incorrectly sent after cross-domain redirect in net/http

LOW 28

The HTTP client drops sensitive headers after following a cross-domain redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0071 Published 2025-01-28 Partial fix · 1.22.11, 1.23.5 +1