SB20260116131 - Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.13
Published: January 16, 2026 Updated: January 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2025-27144)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing JWS and JWE input. A remote attacker can pass specially crafted data to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Race condition (CVE-ID: CVE-2025-47907)
The vulnerability allows an attacker to tamper with the application.
The vulnerability exists due to a race condition when canceling a DB query. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system. A remote user can overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
3) Resource exhaustion (CVE-ID: CVE-2025-58183)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists in archive/tar due to the tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A remote attacker can pass a specially crafted archive to the application and perform a denial of service (DoS) attack.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-58754)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to allocation of resources without limits within data: URL decode. A remote attacker can cause a denial of service condition on the target system.
5) Incorrect default permissions (CVE-ID: CVE-2025-7195)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due the user_setup script set insecure permissions for the /etc/passwd file. A local user with ability to execute commands within an affected container can escalate privileges on the system.
6) Input validation error (CVE-ID: CVE-2025-9287)
The vulnerability allows a remote attacker to manipulate data or perform a denial of service attack.
The vulnerability exists due to a missing type check of untrusted input. A remote attacker can manipulate data representation within the application, which can lead to denial of service conditions or various calculation errors when handling private keys or hashes.
7) Input validation error (CVE-ID: CVE-2025-9288)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a missing type check when handling untrusted input that can lead to calculation of invalid values or rewinding the hash state. A remote attacker can pass specially crafted data to the application and bypass implemented security restrictions.
Remediation
Install update from vendor's website.