Red Hat Security AdvisoryRHSA-2026:54400
VolSync v0.15 security fixes and container updates
Released 2026-08-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/volsync-rhel9
Fixes 5 records
Priority MEDIUM 57
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0691 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00478 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-862
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00683 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-119
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-704
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-347
THREATIST.IORead the docs