Red Hat Security AdvisoryRHSA-2026:36808
DevWorkspace Operator 0.42.0 release.
Released 2026-07-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- DevWorkspace Operator 0.42 registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9, registry.redhat.io/devworkspace/devworkspace-rhel9-operator
Fixes 7 records
Priority MEDIUM 57
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0691 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
Priority MEDIUM 50
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00556 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-863
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.01834 · Published 2026-05-22 · Partial fix · 1.25.13, 1.26.6 +2 CWE-1289
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00683 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-119
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-347
Priority LOW 39
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00361 · Published 2026-04-08 · Partial fix · 1.25.9, 1.26.2 CWE-295
Priority LOW 28
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00369 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
THREATIST.IORead the docs