Red Hat Enterprise Linux (python-jwcrypto, sos, hickory-resolver, libimobiledevice, gcc, python-oauthlib): Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• High 8.4
  CVE-2026-118669 Public exploit

  OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

  OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an…

  oauthlib oauthlib oauthlib python-oauthlib Debian Ubuntu Azure Linux PyPI
  Oct 28, 2026
• High 7.8
  CVE-2026-79655

  Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

  A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extract…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Aug 25, 2026
• High 7.5
  CVE-2026-93657

  hickory-resolver before 0.26.2 DNSSEC Validation Bypass

  hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or posit…

  hickory-dns hickory-resolver rust-hickory-resolver rust-hickory-resolver Debian Ubuntu crates.io
  Sep 18, 2026
• High 7.3
  CVE-2026-116260

  libimobiledevice AFC Service afc.c service_receive double free

  A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The …

  libimobiledevice libimobiledevice Debian Ubuntu
  Oct 26, 2026
• Medium 6.2
  CVE-2026-114690

  Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

  A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compil…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 30, 2026
• Medium 5.9
  CVE-2026-114691

  Gcc: integer wrap in `std

  A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the conta…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 30, 2026
• Medium 5.9
  CVE-2026-92091

  Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

  A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK wit…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Sep 16, 2026

Revision history

1. 2026-11-12 #3

   Neue Updates von Red Hat aufgenommen

2. 2026-11-11 #2

   Neue Updates von Red Hat und Oracle Linux aufgenommen

3. 2026-11-10 #1

   Initiale Fassung

References

• Red Hat Security Advisory RHSA-2026:97858 vom 2026-11-10
  https://access.redhat.com/errata/RHSA-2026:97858
• RedHat Customer Portal vom 2026-11-10
  https://access.redhat.com/security/cve/cve-2026-92091
• Red Hat Security Advisory RHSA-2026:97867 vom 2026-11-10
  https://access.redhat.com/errata/RHSA-2026:97867
• RedHat Customer Portal vom 2026-11-10
  https://access.redhat.com/security/cve/cve-2026-79655
• Red Hat Security Advisory RHSA-2026:97868 vom 2026-11-10
  https://access.redhat.com/errata/RHSA-2026:97868
• RedHat Customer Portal vom 2026-11-10
  https://access.redhat.com/security/cve/cve-2026-93657
• Red Hat Security Advisory RHSA-2026:98105 vom 2026-11-10
  https://access.redhat.com/errata/RHSA-2026:98105
• PoC für CVE-2026-114690
  https://bugzilla.redhat.com/show_bug.cgi?id=2478652
• PoC für CVE-2026-114691
  https://bugzilla.redhat.com/show_bug.cgi?id=2478508
• PoC für CVE-2026-116260
  https://bohmiiiidd.kyubisec.com/#/article/blog-afc-writeup
• PoC für CVE-2026-118669
  https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c
• PoC für CVE-2026-79655
  https://github.com/sosreport/sos/issues/4460
• PoC für CVE-2026-92091
  https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h
• Red Hat Security Advisory RHSA-2026:98648 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98648
• Red Hat Security Advisory RHSA-2026:98076 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98076
• Red Hat Security Advisory RHSA-2026:98075 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98075
• Red Hat Security Advisory RHSA-2026:98061 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98061
• Red Hat Security Advisory RHSA-2026:99023 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99023
• Red Hat Security Advisory RHSA-2026:99167 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99167
• Red Hat Security Advisory RHSA-2026:99027 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99027
• Red Hat Security Advisory RHSA-2026:98534 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98534
• Red Hat Security Advisory RHSA-2026:98633 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98633
• Oracle Linux Security Advisory ELSA-2026-98105 vom 2026-11-12
  http://linux.oracle.com/errata/ELSA-2026-98105.html
• Red Hat Security Advisory RHSA-2026:99019 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99019
• Red Hat Security Advisory RHSA-2026:99026 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99026
• Red Hat Security Advisory RHSA-2026:99025 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99025
• Red Hat Security Advisory RHSA-2026:99022 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99022
• Red Hat Security Advisory RHSA-2026:98526 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98526
• Red Hat Security Advisory RHSA-2026:99024 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99024
• Red Hat Security Advisory RHSA-2026:98524 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98524
• Red Hat Security Advisory RHSA-2026:98641 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98641
• Red Hat Security Advisory RHSA-2026:98640 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98640
• Red Hat Security Advisory RHSA-2026:99021 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99021
• Rocky Linux Security Advisory RLSA-2026:98115 vom 2026-11-12
  https://errata.build.resf.org/RLSA-2026:98115
• Rocky Linux Security Advisory RLSA-2026:98105 vom 2026-11-12
  https://errata.build.resf.org/RLSA-2026:98105
• Red Hat Security Advisory RHSA-2026:99632 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99632
• Rocky Linux Security Advisory RLSA-2026:98648 vom 2026-11-13
  https://errata.build.resf.org/RLSA-2026:98648
• Rocky Linux Security Advisory RLSA-2026:98076 vom 2026-11-13
  https://errata.build.resf.org/RLSA-2026:98076