A vulnerability in FreeIPA, a system used for managing user identities in Linux domains, allows unauthenticated clients to create their own Kerberos identities. This flaw could enable an attacker to gain access to the administrators group without ever having logged in. The exploit relies on a second vulnerability in the 389 Directory Server, which FreeIPA uses to store identity information. Red Hat has acknowledged the issue, which poses a significant risk to systems that rely on FreeIPA for user management. Organizations using FreeIPA should prioritize addressing this flaw to prevent unauthorized administrative access.
Articles tagged "Red Hat"
Found 12 articles
Critical
CISA Warns of Six Exploited Flaws in Microsoft, Linux, Red Hat and Citrix ProductsInfosecurity Magazine
Actively Exploited
On August 26, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that these flaws are being actively exploited by attackers. The affected products include software from Microsoft, Linux, Red Hat, and Citrix, which are widely used in various computing environments. This is a significant concern for organizations relying on these systems, as attackers could leverage these vulnerabilities to gain unauthorized access or disrupt services. Companies should prioritize patching these flaws to mitigate potential risks. The ongoing exploitation of these vulnerabilities underscores the need for vigilance in maintaining software security.
Actively Exploited
The Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating they are currently being exploited in the wild. These vulnerabilities affect a variety of systems, including Red Hat Libuser, Microsoft SQL Server, and Citrix NetScaler, among others. The identified vulnerabilities range from privilege escalation to remote code execution, posing serious risks to federal agencies and potentially impacting other organizations as well. CISA urges all entities to prioritize fixing these vulnerabilities to protect their systems, especially those that expose critical assets to attackers. The agency encourages reporting any additional exploited vulnerabilities that are not yet in the KEV Catalog for potential inclusion.
Red Hat and the Keycloak project have issued important patches to fix a severe security vulnerability in Keycloak, an open-source identity and access management server. This flaw, identified as CVE-2026-18963, allows unauthenticated attackers to reset passwords and potentially take over any user account without needing prior access. Rated 9.1 on the CVSS scale, this vulnerability poses a significant risk to organizations using Keycloak for managing user identities and access. Users and administrators are strongly advised to apply the patches immediately to protect their systems and prevent unauthorized account access.
A newly disclosed vulnerability in the Linux kernel, known as RefluXFS and tracked as CVE-2026-64600, allows unprivileged local users to overwrite files owned by the root user on systems using the XFS filesystem. This flaw, which has been around for nine years, can grant persistent root access to attackers on default installations of Red Hat Enterprise Linux (RHEL), Fedora Server, and Amazon Linux. Researchers from Qualys demonstrated how this vulnerability can be exploited, raising significant concerns for system administrators and users of these platforms. Given the potential for local users to gain elevated privileges, it is crucial for affected organizations to assess their systems and apply necessary mitigations to prevent unauthorized access.
AI-generated reports push GNOME to shorten its disclosure window
Help Net Security
The GNOME project is responding to a surge in AI-generated security vulnerability reports that are being submitted to its maintainers. Many of these reports do not disclose that they were created using language models, leading to an overwhelming volume of submissions. As a result, GNOME is changing its policies regarding how it tracks and discloses vulnerabilities. Michael Catanzaro, who has been overseeing GNOME's security issue tracking since late 2020, is at the forefront of these changes. This shift is significant because it aims to improve the efficiency of handling security issues in open source projects, ensuring that genuine vulnerabilities are prioritized amidst the noise created by automated reports.
Schneider Electric's PowerChute Serial Shutdown software has several vulnerabilities that could allow attackers to manipulate system files, inject malicious data, or gain unauthorized access to accounts. Versions 1.4 and earlier are affected by these security flaws, which include issues like improper path restrictions and output handling. If exploited, these vulnerabilities could disrupt services or expose sensitive information across critical sectors such as energy, healthcare, and transportation. Users of affected versions are urged to upgrade to version 1.5, which includes fixes for these issues. The vulnerabilities were disclosed recently, and it is crucial for organizations to address them promptly to mitigate potential risks.
IBM and Red Hat are launching a new initiative called Project Lightwell, which involves deploying 20,000 engineers to address vulnerabilities identified by Anthropic's AI tool, Mythos. This comes amid growing concerns about the security of the open-source software supply chain, particularly as more companies rely on open-source components. The findings from Mythos have sparked discussions in the tech community about how to better secure these systems and prevent potential exploitation. This investment reflects a significant commitment to improving software security, especially in light of increasing cyber threats targeting open-source software. As organizations continue to adopt open-source solutions, ensuring their safety becomes crucial to protecting sensitive data and maintaining system integrity.
Actively Exploited
A newly discovered vulnerability in the Linux kernel, identified as CVE-2026-46331 and dubbed 'pedit COW', poses a significant risk by allowing unprivileged local users to gain root access on affected systems. This flaw resides in the traffic-control subsystem, specifically in the packet-editing action (act_pedit), which can lead to an out-of-bounds write that corrupts shared page-cache memory. The public release of a working exploit occurred just a day after the vulnerability was disclosed on June 16, raising concerns about its potential for exploitation. Red Hat has classified this flaw as important, emphasizing the urgency for users to assess their systems and apply necessary security measures. Given the rapid emergence of exploits, organizations using Linux systems should prioritize patching and monitoring for unusual activity to mitigate the risk of unauthorized access.
Actively Exploited
A recent breach involving Red Hat’s self-managed GitLab has compromised the data of approximately 21,000 Nissan customers. The Japanese automaker confirmed that attackers accessed their GitLab instance, which is used by Red Hat Consulting. This incident raises significant concerns about data security, especially given the sensitive nature of the information that may have been stolen. Such breaches can lead to identity theft and further exploitation of affected individuals. Companies like Nissan must prioritize their cybersecurity measures to protect customer data and maintain trust.
Nissan Confirms Impact From Red Hat Data Breach
SecurityWeek
Nissan has confirmed that the personal information of approximately 21,000 customers was compromised due to a data breach involving Red Hat's GitLab instances. Hackers gained unauthorized access to sensitive data, raising concerns about the security of customer information in the automotive industry. This incident emphasizes the ripple effects that breaches at major technology providers can have on their clients. The stolen data could potentially be used for identity theft or phishing attacks, putting affected customers at risk. Companies like Nissan must prioritize robust cybersecurity measures to protect customer data and maintain trust.
Nissan says thousands of customers exposed in Red Hat breach
BleepingComputer
Nissan has reported that a data breach at Red Hat has compromised the personal information of thousands of its customers. The breach, which occurred in September, has raised concerns about the security of customer data, as it highlights vulnerabilities in third-party services that companies rely on. Nissan has not specified the exact nature of the compromised information, but the incident emphasizes the risks associated with data sharing among businesses. Customers are urged to monitor their accounts for any suspicious activity and to remain vigilant about potential phishing attempts that could arise from the breach. This incident serves as a reminder for companies to assess their security measures and the safeguards in place for customer data.