{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ndotnet8.0:\n  * aspnetcore-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * aspnetcore-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * aspnetcore-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * dotnet-apphost-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * dotnet-hostfxr-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * dotnet-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * dotnet-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * dotnet-sdk-8.0-8.0.128-1.2.hum1 (aarch64, x86_64)\n  * dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.2.hum1 (aarch64, x86_64)\n  * dotnet-sdk-dbg-8.0-8.0.128-1.2.hum1 (aarch64, x86_64)\n  * dotnet-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64)\n  * dotnet-templates-8.0-8.0.128-1.2.hum1 (aarch64, x86_64)\n  * dotnet8.0-8.0.128-1.2.hum1.src (src)\n\nSecurity Fix(es):\n\ndotnet8.0:\n  * CVE-2026-53486",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:40415",
        "url": "https://access.redhat.com/errata/RHSA-2026:40415"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-53486",
        "url": "https://access.redhat.com/security/cve/CVE-2026-53486"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40415.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-07-30T19:03:20+00:00",
      "generator": {
        "date": "2026-07-30T19:03:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:40415",
      "initial_release_date": "2026-07-15T21:53:54+00:00",
      "revision_history": [
        {
          "date": "2026-07-15T21:53:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-25T05:39:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-30T19:03:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dotnet8-0-main@aarch64",
                "product": {
                  "name": "dotnet8-0-main@aarch64",
                  "product_id": "dotnet8-0-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/aspnetcore-runtime-8.0@8.0.28-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dotnet8-0-main@x86_64",
                "product": {
                  "name": "dotnet8-0-main@x86_64",
                  "product_id": "dotnet8-0-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/aspnetcore-runtime-8.0@8.0.28-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dotnet8-0-main@src",
                "product": {
                  "name": "dotnet8-0-main@src",
                  "product_id": "dotnet8-0-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/dotnet8.0@8.0.128-1.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet8-0-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:dotnet8-0-main@aarch64"
        },
        "product_reference": "dotnet8-0-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet8-0-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:dotnet8-0-main@src"
        },
        "product_reference": "dotnet8-0-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dotnet8-0-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:dotnet8-0-main@x86_64"
        },
        "product_reference": "dotnet8-0-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53486",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-14T21:04:22.589145+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500679"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the decompress package for Node.js. A remote attacker can exploit this vulnerability by crafting a malicious archive. When the archive is extracted, it can create files and links outside the intended directory, leading to unauthorized reading or writing of files. This is due to improper handling of hardlink and symlink entries, insufficient path containment checks, and failure to remove setuid, setgid, or sticky bits from file modes. This can result in high confidentiality and integrity impacts.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Build of Keycloak, Red Hat Advanced Cluster Management (VolSync), Red Hat Hardened Images (dotnet8.0), and the Fedora/EPEL yarnpkg packages bundle the original, unmaintained npm decompress package (version 4.2.1 or earlier), which does not receive an upstream fix for this issue. None of these components use the actively maintained @xhmikosr/decompress fork that received the fix in versions 10.2.1 and 11.1.3. Red Hat rates this issue with a CVSS score of 8.1 (Important), reflecting that in these products archive extraction is performed on locally supplied or build-time archives rather than automatically on arbitrary network-supplied input, which Red Hat scores as requiring user interaction (UI:R) in contrast to the upstream CVSS score of 9.1.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:dotnet8-0-main@aarch64",
          "Red Hat Hardened Images:dotnet8-0-main@src",
          "Red Hat Hardened Images:dotnet8-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53486"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500679",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500679"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53486",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53486"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53486",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53486"
        },
        {
          "category": "external",
          "summary": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd",
          "url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd"
        },
        {
          "category": "external",
          "summary": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae",
          "url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae"
        },
        {
          "category": "external",
          "summary": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89",
          "url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89"
        },
        {
          "category": "external",
          "summary": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd",
          "url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd"
        },
        {
          "category": "external",
          "summary": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1",
          "url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3",
          "url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9",
          "url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"
        }
      ],
      "release_date": "2026-07-14T20:07:14.190000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-15T21:53:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:dotnet8-0-main@aarch64",
            "Red Hat Hardened Images:dotnet8-0-main@src",
            "Red Hat Hardened Images:dotnet8-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:40415"
        },
        {
          "category": "workaround",
          "details": "There is no upstream fix for the original, unmaintained decompress npm package used by these components (last release 4.2.1). The maintained fork, @xhmikosr/decompress, resolves this issue in versions 10.2.1 and 11.1.3, but is not used by any affected Red Hat component. As a general mitigation, only extract archives from trusted sources with the affected tooling, run extraction as a non-root user to prevent the setuid/setgid/sticky-bit issue from creating a privileged file, and verify that any symlinks or hardlinks produced by extraction resolve inside the intended output directory.",
          "product_ids": [
            "Red Hat Hardened Images:dotnet8-0-main@aarch64",
            "Red Hat Hardened Images:dotnet8-0-main@src",
            "Red Hat Hardened Images:dotnet8-0-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:dotnet8-0-main@aarch64",
            "Red Hat Hardened Images:dotnet8-0-main@src",
            "Red Hat Hardened Images:dotnet8-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:dotnet8-0-main@aarch64",
          "Red Hat Hardened Images:dotnet8-0-main@src",
          "Red Hat Hardened Images:dotnet8-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-15T21:53:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:dotnet8-0-main@aarch64",
            "Red Hat Hardened Images:dotnet8-0-main@src",
            "Red Hat Hardened Images:dotnet8-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:40415"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Hardened Images:dotnet8-0-main@aarch64",
            "Red Hat Hardened Images:dotnet8-0-main@src",
            "Red Hat Hardened Images:dotnet8-0-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:dotnet8-0-main@aarch64",
            "Red Hat Hardened Images:dotnet8-0-main@src",
            "Red Hat Hardened Images:dotnet8-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    }
  ]
}