Vulnerability report for Docker rabbitmq:3-management

Vulnerabilities	80 via 154 paths
Dependencies	110
Source	Docker
Target OS	ubuntu:24.04

Test your Docker Hub image against our market leading vulnerability database Sign up for free

Severity

Critical
High
2
Medium
51
Low
27

Status

Open
80
Patched
0
Ignored
0

high severity

Out-of-bounds Write

Vulnerable module: gnupg2/gpgv
Introduced through: gnupg2/gpgv@2.4.4-2ubuntu17.3
Fixed in: 2.4.4-2ubuntu17.4

Detailed paths

Introduced through: rabbitmq@3-management › gnupg2/gpgv@2.4.4-2ubuntu17.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Remediation

Upgrade Ubuntu:24.04 gnupg2 to version 2.4.4-2ubuntu17.4 or higher.

References

Out-of-bounds Write vulnerability report

high severity

new

CVE-2026-45447

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition.

In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-45447 vulnerability report

medium severity

new

Improper Null Termination

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Improper Null Termination vulnerability report

medium severity

new

Integer Underflow

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Integer Underflow vulnerability report

medium severity

new

Improper Validation of Specified Quantity in Input

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Improper Validation of Specified Quantity in Input vulnerability report

medium severity

new

Improper Validation of Specified Quantity in Input

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Improper Validation of Specified Quantity in Input vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat/libexpat1
Introduced through: expat/libexpat1@2.6.1-2ubuntu0.3
Fixed in: 2.6.1-2ubuntu0.4

Detailed paths

Introduced through: rabbitmq@3-management › expat/libexpat1@2.6.1-2ubuntu0.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

Remediation

Upgrade Ubuntu:24.04 expat to version 2.6.1-2ubuntu0.4 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Directory Traversal

Vulnerable module: pam/libpam-modules
Introduced through: pam/libpam-modules@1.5.3-5ubuntu5.5, pam/libpam-modules-bin@1.5.3-5ubuntu5.5 and others

Detailed paths

Introduced through: rabbitmq@3-management › pam/libpam-modules@1.5.3-5ubuntu5.5
Introduced through: rabbitmq@3-management › pam/libpam-modules-bin@1.5.3-5ubuntu5.5
Introduced through: rabbitmq@3-management › pam/libpam-runtime@1.5.3-5ubuntu5.5
Introduced through: rabbitmq@3-management › pam/libpam0g@1.5.3-5ubuntu5.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Remediation

There is no fixed version for Ubuntu:24.04 pam.

References

Directory Traversal vulnerability report

medium severity

new

Improper Handling of Length Parameter Inconsistency

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Improper Handling of Length Parameter Inconsistency vulnerability report

medium severity

new

Undefined Behavior for Input to API

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Undefined Behavior for Input to API vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others
Fixed in: 3.12.3-1ubuntu0.10

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.12 package and not the python3.12 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

Remediation

Upgrade Ubuntu:24.04 python3.12 to version 3.12.3-1ubuntu0.10 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

new

Improper Certificate Validation

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

new

Improper Handling of Case Sensitivity

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Improper Handling of Case Sensitivity vulnerability report

medium severity

new

Improper Certificate Validation

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: libcap2
Introduced through: libcap2@1:2.66-5ubuntu2.2
Fixed in: 1:2.66-5ubuntu2.4

Detailed paths

Introduced through: rabbitmq@3-management › libcap2@1:2.66-5ubuntu2.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcap2 package and not the libcap2 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Remediation

Upgrade Ubuntu:24.04 libcap2 to version 1:2.66-5ubuntu2.4 or higher.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

new

Expired Pointer Dereference

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in GnuTLS. The gnutls_pkcs11_token_set_pin function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Expired Pointer Dereference vulnerability report

medium severity

Algorithmic Complexity

Vulnerable module: expat/libexpat1
Introduced through: expat/libexpat1@2.6.1-2ubuntu0.3

Detailed paths

Introduced through: rabbitmq@3-management › expat/libexpat1@2.6.1-2ubuntu0.3

NVD Description

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Remediation

There is no fixed version for Ubuntu:24.04 expat.

References

Algorithmic Complexity vulnerability report

medium severity

CVE-2025-13837

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others
Fixed in: 3.12.3-1ubuntu0.11

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Remediation

Upgrade Ubuntu:24.04 python3.12 to version 3.12.3-1ubuntu0.11 or higher.

References

CVE-2025-13837 vulnerability report

medium severity

Unrestricted Upload of File with Dangerous Type

Vulnerable module: tar
Introduced through: tar@1.35+dfsg-3build1

Detailed paths

Introduced through: rabbitmq@3-management › tar@1.35+dfsg-3build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Remediation

There is no fixed version for Ubuntu:24.04 tar.

References

Unrestricted Upload of File with Dangerous Type vulnerability report

medium severity

Algorithmic Complexity

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.5

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.5 or higher.

References

Algorithmic Complexity vulnerability report

medium severity

new

Off-by-one Error

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Off-by-one Error vulnerability report

medium severity

CVE-2025-12084

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others
Fixed in: 3.12.3-1ubuntu0.11

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Remediation

Upgrade Ubuntu:24.04 python3.12 to version 3.12.3-1ubuntu0.11 or higher.

References

CVE-2025-12084 vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: gnupg2/gpgv
Introduced through: gnupg2/gpgv@2.4.4-2ubuntu17.3

Detailed paths

Introduced through: rabbitmq@3-management › gnupg2/gpgv@2.4.4-2ubuntu17.3

NVD Description

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Remediation

There is no fixed version for Ubuntu:24.04 gnupg2.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

new

Incorrect Behavior Order: Early Validation

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Incorrect Behavior Order: Early Validation vulnerability report

medium severity

new

Information Exposure

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.6

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.6 or higher.

References

Information Exposure vulnerability report

medium severity

CVE-2025-13462

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Remediation

There is no fixed version for Ubuntu:24.04 python3.12.

References

CVE-2025-13462 vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: expat/libexpat1
Introduced through: expat/libexpat1@2.6.1-2ubuntu0.3
Fixed in: 2.6.1-2ubuntu0.4

Detailed paths

Introduced through: rabbitmq@3-management › expat/libexpat1@2.6.1-2ubuntu0.3

NVD Description

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

Remediation

Upgrade Ubuntu:24.04 expat to version 2.6.1-2ubuntu0.4 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

CVE-2026-2219

Vulnerable module: dpkg
Introduced through: dpkg@1.22.6ubuntu6.5
Fixed in: 1.22.6ubuntu6.6

Detailed paths

Introduced through: rabbitmq@3-management › dpkg@1.22.6ubuntu6.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream dpkg package and not the dpkg package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

Remediation

Upgrade Ubuntu:24.04 dpkg to version 1.22.6ubuntu6.6 or higher.

References

CVE-2026-2219 vulnerability report

medium severity

CVE-2025-15281

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6
Fixed in: 2.39-0ubuntu8.7

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

Remediation

Upgrade Ubuntu:24.04 glibc to version 2.39-0ubuntu8.7 or higher.

References

CVE-2025-15281 vulnerability report

medium severity

CVE-2026-0861

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6
Fixed in: 2.39-0ubuntu8.7

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.

Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

Remediation

Upgrade Ubuntu:24.04 glibc to version 2.39-0ubuntu8.7 or higher.

References

CVE-2026-0861 vulnerability report

medium severity

CVE-2026-0915

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6
Fixed in: 2.39-0ubuntu8.7

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.

Remediation

Upgrade Ubuntu:24.04 glibc to version 2.39-0ubuntu8.7 or higher.

References

CVE-2026-0915 vulnerability report

medium severity

CVE-2026-4046

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-4046 vulnerability report

medium severity

CVE-2026-4437

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-4437 vulnerability report

medium severity

CVE-2026-4438

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-4438 vulnerability report

medium severity

new

CVE-2026-5435

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-5435 vulnerability report

medium severity

new

CVE-2026-6238

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-6238 vulnerability report

medium severity

new

Out-of-bounds Write

Vulnerable module: libgcrypt20
Introduced through: libgcrypt20@1.10.3-2build1
Fixed in: 1.10.3-2ubuntu0.1

Detailed paths

Introduced through: rabbitmq@3-management › libgcrypt20@1.10.3-2build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Remediation

Upgrade Ubuntu:24.04 libgcrypt20 to version 1.10.3-2ubuntu0.1 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: libtasn1-6
Introduced through: libtasn1-6@4.19.0-3ubuntu0.24.04.1
Fixed in: 4.19.0-3ubuntu0.24.04.2

Detailed paths

Introduced through: rabbitmq@3-management › libtasn1-6@4.19.0-3ubuntu0.24.04.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1-6 package and not the libtasn1-6 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.

Remediation

Upgrade Ubuntu:24.04 libtasn1-6 to version 4.19.0-3ubuntu0.24.04.2 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

CVE-2025-15467

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow.

Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution.

When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.

OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2025-15467 vulnerability report

medium severity

CVE-2026-31790

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.9

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker.

RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced.

If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext.

As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue.

The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.9 or higher.

References

CVE-2026-31790 vulnerability report

medium severity

new

CVE-2026-34182

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.

In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message.

An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success.

If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message.

In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content.

The FIPS modules are not affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-34182 vulnerability report

medium severity

new

CVE-2026-45445

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-45445 vulnerability report

medium severity

CVE-2025-11468

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others
Fixed in: 3.12.3-1ubuntu0.11

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

Remediation

Upgrade Ubuntu:24.04 python3.12 to version 3.12.3-1ubuntu0.11 or higher.

References

CVE-2025-11468 vulnerability report

medium severity

CVE-2025-15282

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others
Fixed in: 3.12.3-1ubuntu0.11

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Remediation

Upgrade Ubuntu:24.04 python3.12 to version 3.12.3-1ubuntu0.11 or higher.

References

CVE-2025-15282 vulnerability report

medium severity

CVE-2026-0672

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others
Fixed in: 3.12.3-1ubuntu0.11

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Remediation

Upgrade Ubuntu:24.04 python3.12 to version 3.12.3-1ubuntu0.11 or higher.

References

CVE-2026-0672 vulnerability report

medium severity

CVE-2026-0865

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others
Fixed in: 3.12.3-1ubuntu0.11

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Remediation

Upgrade Ubuntu:24.04 python3.12 to version 3.12.3-1ubuntu0.11 or higher.

References

CVE-2026-0865 vulnerability report

medium severity

CVE-2026-2297

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.9, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9 and others

Detailed paths

Introduced through: rabbitmq@3-management › python3.12@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.9
Introduced through: rabbitmq@3-management › python3.12/python3.12-minimal@3.12.3-1ubuntu0.9

NVD Description

The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.

Remediation

There is no fixed version for Ubuntu:24.04 python3.12.

References

CVE-2026-2297 vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: sed
Introduced through: sed@4.9-2build1
Fixed in: 4.9-2ubuntu0.24.04.1

Detailed paths

Introduced through: rabbitmq@3-management › sed@4.9-2build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream sed package and not the sed package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path:

resolves symlink to its target and stores the resolved path for determining when output is written,
opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.

This issue was fixed in version 4.10.

Remediation

Upgrade Ubuntu:24.04 sed to version 4.9-2ubuntu0.24.04.1 or higher.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Improper Privilege Management

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@255.4-1ubuntu8.11 and systemd/libudev1@255.4-1ubuntu8.11
Fixed in: 255.4-1ubuntu8.14

Detailed paths

Introduced through: rabbitmq@3-management › systemd/libsystemd0@255.4-1ubuntu8.11
Introduced through: rabbitmq@3-management › systemd/libudev1@255.4-1ubuntu8.11

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

Remediation

Upgrade Ubuntu:24.04 systemd to version 255.4-1ubuntu8.14 or higher.

References

Improper Privilege Management vulnerability report

medium severity

new

Incorrect Resource Transfer Between Spheres

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@255.4-1ubuntu8.11 and systemd/libudev1@255.4-1ubuntu8.11
Fixed in: 255.4-1ubuntu8.14

Detailed paths

Introduced through: rabbitmq@3-management › systemd/libsystemd0@255.4-1ubuntu8.11
Introduced through: rabbitmq@3-management › systemd/libudev1@255.4-1ubuntu8.11

NVD Description

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Remediation

Upgrade Ubuntu:24.04 systemd to version 255.4-1ubuntu8.14 or higher.

References

Incorrect Resource Transfer Between Spheres vulnerability report

medium severity

new

Use of Less Trusted Source

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@255.4-1ubuntu8.11 and systemd/libudev1@255.4-1ubuntu8.11
Fixed in: 255.4-1ubuntu8.16

Detailed paths

Introduced through: rabbitmq@3-management › systemd/libsystemd0@255.4-1ubuntu8.11
Introduced through: rabbitmq@3-management › systemd/libudev1@255.4-1ubuntu8.11

NVD Description

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

Remediation

Upgrade Ubuntu:24.04 systemd to version 255.4-1ubuntu8.16 or higher.

References

Use of Less Trusted Source vulnerability report

medium severity

Directory Traversal

Vulnerable module: tar
Introduced through: tar@1.35+dfsg-3build1

Detailed paths

Introduced through: rabbitmq@3-management › tar@1.35+dfsg-3build1

NVD Description

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

Remediation

There is no fixed version for Ubuntu:24.04 tar.

References

Directory Traversal vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: util-linux
Introduced through: util-linux@2.39.3-9ubuntu6.3, util-linux/bsdutils@1:2.39.3-9ubuntu6.3 and others

Detailed paths

Introduced through: rabbitmq@3-management › util-linux@2.39.3-9ubuntu6.3
Introduced through: rabbitmq@3-management › util-linux/bsdutils@1:2.39.3-9ubuntu6.3
Introduced through: rabbitmq@3-management › util-linux/libblkid1@2.39.3-9ubuntu6.3
Introduced through: rabbitmq@3-management › util-linux/libmount1@2.39.3-9ubuntu6.3
Introduced through: rabbitmq@3-management › util-linux/libsmartcols1@2.39.3-9ubuntu6.3
Introduced through: rabbitmq@3-management › util-linux/libuuid1@2.39.3-9ubuntu6.3
Introduced through: rabbitmq@3-management › util-linux/mount@2.39.3-9ubuntu6.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Remediation

There is no fixed version for Ubuntu:24.04 util-linux.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

low severity

CVE-2026-31789

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.9

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.

Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior.

If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow.

Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.9 or higher.

References

CVE-2026-31789 vulnerability report

low severity

CVE-2026-28387

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.9

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.

No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.9 or higher.

References

CVE-2026-28387 vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.6 and glibc/libc6@2.39-0ubuntu8.6

Detailed paths

Introduced through: rabbitmq@3-management › glibc/libc-bin@2.39-0ubuntu8.6
Introduced through: rabbitmq@3-management › glibc/libc6@2.39-0ubuntu8.6

NVD Description

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

CVE-2025-69421

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function.

Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files.

The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure.

Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2025-69421 vulnerability report

low severity

CVE-2026-28388

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.9

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.

Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.

The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.9 or higher.

References

CVE-2026-28388 vulnerability report

low severity

CVE-2026-28389

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.9

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.9 or higher.

References

CVE-2026-28389 vulnerability report

low severity

CVE-2026-28390

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.9

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.9 or higher.

References

CVE-2026-28390 vulnerability report

low severity

Improper Input Validation

Vulnerable module: coreutils
Introduced through: coreutils@9.4-3ubuntu6.1

Detailed paths

Introduced through: rabbitmq@3-management › coreutils@9.4-3ubuntu6.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Ubuntu:24.04 coreutils.

References

Improper Input Validation vulnerability report

low severity

new

Heap-based Buffer Overflow

Vulnerable module: xz-utils/liblzma5
Introduced through: xz-utils/liblzma5@5.6.1+really5.4.5-1ubuntu0.2
Fixed in: 5.6.1+really5.4.5-1ubuntu0.3

Detailed paths

Introduced through: rabbitmq@3-management › xz-utils/liblzma5@5.6.1+really5.4.5-1ubuntu0.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz-utils package and not the xz-utils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Remediation

Upgrade Ubuntu:24.04 xz-utils to version 5.6.1+really5.4.5-1ubuntu0.3 or higher.

References

Heap-based Buffer Overflow vulnerability report

low severity

Stack-based Buffer Overflow

Vulnerable module: gnutls28/libgnutls30t64
Introduced through: gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4
Fixed in: 3.8.3-1.1ubuntu3.5

Detailed paths

Introduced through: rabbitmq@3-management › gnutls28/libgnutls30t64@3.8.3-1.1ubuntu3.4

NVD Description

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

Remediation

Upgrade Ubuntu:24.04 gnutls28 to version 3.8.3-1.1ubuntu3.5 or higher.

References

Stack-based Buffer Overflow vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: gnupg2/gpgv
Introduced through: gnupg2/gpgv@2.4.4-2ubuntu17.3

Detailed paths

Introduced through: rabbitmq@3-management › gnupg2/gpgv@2.4.4-2ubuntu17.3

NVD Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Remediation

There is no fixed version for Ubuntu:24.04 gnupg2.

References

Out-of-bounds Write vulnerability report

low severity

new

Incorrect Resource Transfer Between Spheres

Vulnerable module: systemd/libsystemd0
Introduced through: systemd/libsystemd0@255.4-1ubuntu8.11 and systemd/libudev1@255.4-1ubuntu8.11

Detailed paths

Introduced through: rabbitmq@3-management › systemd/libsystemd0@255.4-1ubuntu8.11
Introduced through: rabbitmq@3-management › systemd/libudev1@255.4-1ubuntu8.11

NVD Description

In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.

Remediation

There is no fixed version for Ubuntu:24.04 systemd.

References

Incorrect Resource Transfer Between Spheres vulnerability report

low severity

Covert Timing Channel

Vulnerable module: libgcrypt20
Introduced through: libgcrypt20@1.10.3-2build1

Detailed paths

Introduced through: rabbitmq@3-management › libgcrypt20@1.10.3-2build1

NVD Description

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Remediation

There is no fixed version for Ubuntu:24.04 libgcrypt20.

References

Covert Timing Channel vulnerability report

low severity

CVE-2025-68160

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write.

Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application.

The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2025-68160 vulnerability report

low severity

CVE-2025-69418

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: When using the low-level OCB API directly with AES-NI or other hardware-accelerated code paths, inputs whose length is not a multiple of 16 bytes can leave the final partial block unencrypted and unauthenticated. Impact summary: The trailing 1-15 bytes of a message may be exposed in cleartext on encryption and are not covered by the authentication tag, allowing an attacker to read or tamper with those bytes without detection. The low-level OCB encrypt and decrypt routines in the hardware-accelerated stream path process full 16-byte blocks but do not advance the input/output pointers. The subsequent tail-handling code then operates on the original base pointers, effectively reprocessing the beginning of the buffer while leaving the actual trailing bytes unprocessed. The authentication checksum also excludes the true tail bytes. However, typical OpenSSL consumers using EVP are not affected because the higher-level EVP and provider OCB implementations split inputs so that full blocks and trailing partial blocks are processed in separate calls, avoiding the problematic code path. Additionally, TLS does not use OCB ciphersuites. The vulnerability only affects applications that call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with non-block-aligned lengths in a single call on hardware-accelerated builds. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as OCB mode is not a FIPS-approved algorithm. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2025-69418 vulnerability report

low severity

CVE-2025-69419

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer.

Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service.

The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.

The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2025-69419 vulnerability report

low severity

CVE-2025-69420

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file.

Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.

The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash.

Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2025-69420 vulnerability report

low severity

CVE-2026-22795

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file.

Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service.

A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read.

The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

OpenSSL 1.0.2 is not affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2026-22795 vulnerability report

low severity

CVE-2026-22796

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.7

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data.

Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.

The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash.

Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.7 or higher.

References

CVE-2026-22796 vulnerability report

low severity

new

CVE-2026-34180

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.

Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated.

An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer.

Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-34180 vulnerability report

low severity

new

CVE-2026-42766

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.

Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.

The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.

An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service.

Applications that process password-encrypted CMS messages may be affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-42766 vulnerability report

low severity

new

CVE-2026-42767

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application.

Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service.

An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client.

Applications that process untrusted CMP/CRMF messages may be affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-42767 vulnerability report

low severity

new

CVE-2026-42770

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership.

Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts.

When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared.

A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack).

The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-42770 vulnerability report

low severity

new

CVE-2026-45446

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages.

Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers.

AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, EVP_DecryptFinal_ex() is documented to return success only if the tag is verified succesfully.

In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls EVP_DecryptFinal_ex() without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value.

When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key.

AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2.

No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-45446 vulnerability report

low severity

new

CVE-2026-7383

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow.

Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour.

In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation.

X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-7383 vulnerability report

low severity

new

CVE-2026-9076

Vulnerable module: openssl
Introduced through: openssl@3.0.13-0ubuntu3.6 and openssl/libssl3t64@3.0.13-0ubuntu3.6
Fixed in: 3.0.13-0ubuntu3.11

Detailed paths

Introduced through: rabbitmq@3-management › openssl@3.0.13-0ubuntu3.6
Introduced through: rabbitmq@3-management › openssl/libssl3t64@3.0.13-0ubuntu3.6

NVD Description

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker.

The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen.

Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds.

The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator.

The FIPS modules are not affected by this issue.

Remediation

Upgrade Ubuntu:24.04 openssl to version 3.0.13-0ubuntu3.11 or higher.

References

CVE-2026-9076 vulnerability report

low severity

CVE-2024-56433

Vulnerable module: shadow/login
Introduced through: shadow/login@1:4.13+dfsg1-4ubuntu3.2 and shadow/passwd@1:4.13+dfsg1-4ubuntu3.2

Detailed paths

Introduced through: rabbitmq@3-management › shadow/login@1:4.13+dfsg1-4ubuntu3.2
Introduced through: rabbitmq@3-management › shadow/passwd@1:4.13+dfsg1-4ubuntu3.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Remediation

There is no fixed version for Ubuntu:24.04 shadow.

References

CVE-2024-56433 vulnerability report

Vulnerabilities

Dependencies

Source

Target OS

high severity

Out-of-bounds Write

Detailed paths

NVD Description

Remediation

References

high severity new

CVE-2026-45447

Detailed paths

NVD Description

Remediation

References

medium severity new

Improper Null Termination

Detailed paths

NVD Description

Remediation

References

medium severity new

Integer Underflow

Detailed paths

NVD Description

Remediation

References

medium severity new

Improper Validation of Specified Quantity in Input

Detailed paths

NVD Description

Remediation

References

medium severity new

Improper Validation of Specified Quantity in Input

Detailed paths

NVD Description

Remediation

References

medium severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

medium severity

Directory Traversal

Detailed paths

NVD Description

Remediation

References

medium severity new

Improper Handling of Length Parameter Inconsistency

Detailed paths

NVD Description

Remediation

References

medium severity new

Undefined Behavior for Input to API

Detailed paths

NVD Description

Remediation

References

medium severity

Out-of-bounds Read

Detailed paths

NVD Description

Remediation

References

medium severity new

Improper Certificate Validation

Detailed paths

NVD Description

Remediation

References

medium severity new

Improper Handling of Case Sensitivity

Detailed paths

NVD Description

high severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new

medium severity

new