Red Hat Security Advisory

RHSA-2025:9178

kea security update

Released 2025-06-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) kea-doc-2.6.3-1.el10_0, kea-hooks-2.6.3-1.el10_0
Red Hat Enterprise Linux BaseOS (v. 10) kea-2.6.3-1.el10_0, kea-libs-2.6.3-1.el10_0
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kea-keama-2.6.3-1.el10_0

TI-2025-23838 CVE-2025-32801 · GHSA-hv8v-455m-2grc

LOW 36

Kea configuration and API directives can be used to load a malicious hook library.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00299 Published 2025-05-28 Fixed CWE-94

TI-2025-23839 CVE-2025-32802 · GHSA-vwc9-wh34-hrfm

LOW 27

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea.

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00226 Published 2025-05-28 Fixed CWE-379

TI-2025-23840 CVE-2025-32803 · GHSA-prj7-2jhj-62fj

LOW 18

In some cases, Kea log files or lease files may be world-readable.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00239 Published 2025-05-28 Fixed CWE-276