RHSA-2026:44568

Vulnerability from csaf_redhat - Published: 2026-07-23 17:10 - Updated: 2026-07-23 17:13
Summary
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update
Severity
Important
Notes
Topic: Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.
Details: Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal as a bootable container (bootc) image. The image provides a self-contained automation portal with pre-configured services, dynamic plugins, and support for air-gapped deployments.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-6473

A flaw was found in PostgreSQL. An integer overflow in multiple server features allows an unprivileged database user to cause an undersized memory allocation that leads to an out-of-bounds write. This issue allows an attacker to execute arbitrary code as the operating system user running the database or, in applications that pass gigabyte-scale user inputs to the relevant database functions, to cause a segmentation fault, resulting in a denial of service.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-6479

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL (Secure Sockets Layer) and GSS (Generic Security Service) negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket. If SSL and GSS are both disabled, the same denial of service can be achieved via a PostgreSQL TCP socket.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal\nas a bootable container (bootc) image. The image provides a self-contained automation portal\nwith pre-configured services, dynamic plugins, and support for air-gapped deployments.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:44568",
        "url": "https://access.redhat.com/errata/RHSA-2026:44568"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6473",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6473"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6479",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6479"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44568.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update",
    "tracking": {
      "current_release_date": "2026-07-23T17:13:15+00:00",
      "generator": {
        "date": "2026-07-23T17:13:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:44568",
      "initial_release_date": "2026-07-23T17:10:22+00:00",
      "revision_history": [
        {
          "date": "2026-07-23T17:10:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-23T17:10:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-23T17:13:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.2",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.2",
                  "product_id": "Red Hat Ansible Automation Platform 2.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_portal:2.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bootc-automation-portal-rhel9@sha256%3Af431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9\u0026tag=1784804630"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64 as a component of Red Hat Ansible Automation Platform 2.2",
          "product_id": "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6473",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-05-14T14:01:48.197406+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477448"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostgreSQL. An integer overflow in multiple server features allows an unprivileged database user to cause an undersized memory allocation that leads to an out-of-bounds write. This issue allows an attacker to execute arbitrary code as the operating system user running the database or, in applications that pass gigabyte-scale user inputs to the relevant database functions, to cause a segmentation fault, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker with minimal access to a database needs to pass extremely large inputs to vulnerable database functions, causing an integer overflow that leads to an out-of-bounds write. This flaw allows an attacker to potentially execute arbitrary code or, more likely, cause a denial of service.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6473"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477448",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477448"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6473",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6473"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6473",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6473"
        },
        {
          "category": "external",
          "summary": "https://www.postgresql.org/support/security/CVE-2026-6473/",
          "url": "https://www.postgresql.org/support/security/CVE-2026-6473/"
        }
      ],
      "release_date": "2026-05-14T13:00:09.446000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-23T17:10:22+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:44568"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, validate the length of data and the size of objects on all client APIs and web interfaces. Also, block, drop, or truncate oversized string, array, or binary objects before they are passed into backend SQL queries.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write"
    },
    {
      "cve": "CVE-2026-6479",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-14T14:01:40.164297+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477445"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostgreSQL. Uncontrolled recursion during SSL (Secure Sockets Layer) and GSS (Generic Security Service) negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket. If SSL and GSS are both disabled, the same denial of service can be achieved via a PostgreSQL TCP socket.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Uncontrolled recursion during PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL socket to trigger sustained CPU/stack exhaustion, resulting in denial of service. This affects the core connection-negotiation path, which runs unconditionally for every incoming connection attempt regardless of configuration \u2014 there is no optional feature or code path that must be enabled for exploitation, unlike some other recent flaws in this batch. Fix versions are 18.4, 17.10, 16.14, 15.18, and 14.23; PostgreSQL 12 and 13 branches are not listed as affected by upstream and do not contain the vulnerable recursion path. Affects were determined purely by comparing each shipped build\u0027s PostgreSQL version against these per-major-version fix thresholds.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6479"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477445",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477445"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6479",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6479"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6479",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6479"
        },
        {
          "category": "external",
          "summary": "https://www.postgresql.org/support/security/CVE-2026-6479/",
          "url": "https://www.postgresql.org/support/security/CVE-2026-6479/"
        }
      ],
      "release_date": "2026-05-14T13:00:13.859000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-23T17:10:22+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:44568"
        },
        {
          "category": "workaround",
          "details": "Upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23 (matching your major version) or later. Restricting network/socket access to trusted clients reduces exposure but does not eliminate the vulnerability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:f431dddfcb88b3d90db1607423bc451993dd39e7e182b047cf673594d39bc186_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.