Skip to content
OpenAdvisories
High RHSA-2026:45940 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Aug 5, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 26

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 clang21 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 clang21-analyzer 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 clang21-devel 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 clang21-libs 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 clang21-resource-filesystem 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 clang21-tools-extra 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 clang21-tools-extra-devel 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 compiler-rt21 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 git-clang-format21 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 libomp21 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 libomp21-devel 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 lld21 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 lld21-devel 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 lld21-libs 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 lldb21 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 lldb21-devel 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-cmake-utils 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-devel 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-doc 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-filesystem 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-googletest 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-libs 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-static 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 llvm21-test 0:21.1.8-8.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3-clang21 0:21.1.8-8.hum1

Vulnerabilities 4

  • High 8.8
    CVE-2026-67325

    GitPython before 3.1.51 Command Injection via option prefix abbreviation

    GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload…

    gitpython-developers GitPython checkov gitpython Debian Ubuntu Wolfi PyPI
  • High 8.4
    CVE-2026-67323

    GitPython before 3.1.51 Command Injection via unguarded Git options

    GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally,…

    gitpython-developers GitPython checkov gitpython Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-67322

    GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

    GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. …

    gitpython-developers GitPython checkov gitpython Debian Ubuntu Wolfi PyPI
  • High 7.0
    CVE-2026-67326

    GitPython before 3.1.50 Newline Injection via config_writer section

    GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath p…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-67322
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-67326
  • report
    https://access.redhat.com/security/cve/CVE-2026-67323
  • report
    https://access.redhat.com/security/cve/CVE-2026-67325
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45940.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510021
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67322
  • article
    https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573
  • article
    https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509976
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67323
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67323
  • article
    https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v
  • article
    https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509975
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67325
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67325
  • article
    https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx
  • article
    https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510003
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67326
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67326
  • article
    https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w
  • article
    https://www.vulncheck.com/advisories/gitpython-before-newline-injection-via-config-writer-section