RHSA-2025:15837HighCVSS 7.5
Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)
🔗 CVE IDs covered (2)
📋 Description
CVE-2025-47277 — vllm: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service CVE-2025-48379 — python-pillow: pillow: Pillow DDS Heap Buffer Overflow
🎯 Affected products2
- Red Hat Enterprise Linux AI 1.5
- registry.redhat.io/rhelai1/bootc-gcp-nvidia-rhel9@sha256:e0f422a906d386596295e99b64c6158ae44b6b8a12be30868865e76742fccb17_amd64 as a component of Red Hat Enterprise Linux AI 1.5
✅ Remediation
For more information visit https://access.redhat.com/errata/RHSA-2025:15837 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2025:15837
- externalhttps://access.redhat.com/security/cve/CVE-2025-48379
- externalhttps://access.redhat.com/security/cve/cve-2025-47277
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://www.redhat.com/en/technologies/linux-platforms/enterprise-linux/ai
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15837.json