RHSA-2026:89907CriticalCVSS 8.2

Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

Published
October 26, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (7)

CVE-2026-19953 →CVE-2026-59997 →CVE-2026-59998 →CVE-2026-60000 →CVE-2026-77214 →CVE-2026-102633 →CVE-2026-114406 →

📋 Description

CVE-2026-19953 — URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-59997 — openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-59998 — openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory CVE-2026-60000 — openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts CVE-2026-77214 — expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer CVE-2026-102633 — expat: expat: Denial of Service via integer overflow in expat_realloc CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products6

  • Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:d52ec16fcf7c723fbe065397bd685fdfbc5e845f782fa05c200597495a8b36cf_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-rhel9@sha256:71f357468bcb6367a15c0f868481653caade9db6a4d0fa36869bfecd70d11958_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/haproxy-rhel9@sha256:c9b0b3e0e77209c3352ed8c6be19f27a0598556bba357783fa517db465dd3eed_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/installer-rhel9@sha256:f8f7b95e96da75fa630092e5f14a644e8436fff4bb90ad0344f96aa24453f0de_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:01b5c0c6c3e5c009171bcfd20e452d2fcc28dd552c52aeb30b1b287547828e2d_amd64 as a component of Red Hat Update Infrastructure 5

✅ Remediation

The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that all security-relevant command-line arguments for the `internal-sftp` server are positioned within the first nine arguments. Alternatively, consider using the default SFTP server implementation if custom configurations relying on numerous arguments are not strictly necessary. If `internal-sftp` is used with more than nine arguments, verify that no critical security options are being silently discarded. Workaround: To mitigate this issue, avoid using GSSAPI authentication for `sshd` when the server is integrated with a Windows Active Directory environment. If GSSAPI authentication is not strictly required, it can be disabled by setting `GSSAPIAuthentication no` in the `/etc/ssh/sshd_config` file. After modifying the configuration, the `sshd` service must be restarted for the changes to take effect. Note that restarting the `sshd` service will terminate all active SSH sessions. ```bash # echo "GSSAPIAuthentication no" >> /etc/ssh/sshd_config # systemctl restart sshd ``` Alternatively, if GSSAPI authentication is necessary in such an environment, ensure that the network path between the client and the `sshd` server, and to the Active Directory, is secured and trusted to prevent man-in-the-middle attacks. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (12)