Skip to content
OpenAdvisories
High RHSA-2026:63151 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 4, 2026 · Updated Sep 22, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 composer 0:2.10.3-1.hum1

Vulnerabilities 2

  • High 7.7
    CVE-2026-84361 Public exploit

    Composer: Perforce source URL permits P4PORT `rsh:` command execution

    Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist
  • Medium 6.1
    CVE-2026-59944

    Composer: CVE-2026-59946 fix bypass via symlinked package bin path

    Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory seg…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-84361
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-59944
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63151.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535546
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59944
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59944
  • article
    https://github.com/composer/composer/commit/53b8bb4c24697b2f00a18cf1ef35a10392701b89
  • article
    https://github.com/composer/composer/commit/ad649fdfdf8ed826d4a34e0e5690c76a0b4833aa
  • article
    https://github.com/composer/composer/releases/tag/2.10.3
  • article
    https://github.com/composer/composer/releases/tag/2.2.30
  • article
    https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2527051
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-84361
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-84361
  • article
    https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220
  • article
    https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af
  • article
    https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3