RHSA-2025:23248HighCVSS 7.7

Red Hat Security Advisory: RHSA 4.7.9 security and bug fix update

Published
December 16, 2025
Last Modified
September 17, 2026

🔗 CVE IDs covered (5)

CVE-2025-6965 →CVE-2025-9648 →CVE-2025-47907 →CVE-2025-59375 →CVE-2024-25621 →

📋 Description

CVE-2024-25621 — github.com/containerd/containerd: containerd local privilege escalation CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-9648 — civetweb: Denial of Service in CivetWeb CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:18357de02f0f56d741dd4e184465157b0035550c151c29c4a0387d58cf269106_arm64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:6ec722f4a9558cd2c409811b2da56a0af971a7f586a8d3c7a1ae1f47e25c7fb5_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:8d1e602d5f01328cfd56e84a29a997483ee882a437e10003bbec959156305ebc_ppc64le as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:b3d0ab6ed732624f6cc3b942d4bfcbcd372d61ce6b60b901a74361ba57874069_s390x as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:0ba8b652771a517a5c724bc91bbca265a8e86efdd2e83b504c8fb309715a3758_s390x as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:271dd3bfa99f1043d3ee885764fda7d3ba89c232025c1d3ad7fe45324f47473d_arm64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:488e7716dc50df623f9088ee36120266d4db2637e2d2ce89810f1fdd8f2161f0_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:e3444345f04c1569ec97530ddd6b6e4ccd38a2887d500054ac93f76f54c07aa8_ppc64le as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:1b131d4fcd2b6b608ea9467195df55e796e2b26a889651f6d294038910dbf795_ppc64le as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:31788e355827257ff14af5a9ed16a627fd203f8897a6c3ce0793fd5dac8e25e8_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:8f4bf042e7b4e0d240e6d78d450d7fb985482393154d9c6e505c42d6c6121f98_s390x as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:c019cadfc51234635a8e7858ee74107395a238c950ec91c27f07a1dea0a17ce6_arm64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:e7106f927313f2e0a08c85cf1ecfd1338d222f02dcac6c40846858a7e0c9c32b_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:56202276aaeb96ecaf5f2729d0644811dd64096aeed1a407735091d0b1086b06_s390x as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:9acef94305c74d27d6a047ed051adf7efbe855bf406bf8fc583c32451a4a79c6_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:9f4f55e287380e5c8ec9b7bb55846b878475877ff0802681817801f87ccc5238_ppc64le as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:c623e12a1c28e70cbd6a350c784f07fe785db424b6b0a9cd4100edda52426c54_arm64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:5a7d70dc0c30c94329937d7ef2a8b6ac6344da79bf6f153fdcf828ed5bdf148d_ppc64le as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:82b148211af601cfba5b588653ab2f5cfae938b56268436d7dd6a8055a895e6e_s390x as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:af2cbab59c3cdc12e60a3e1c94f913005633ff6566f424b947ec0b15cd5e7a9f_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:e81aa3e198d77dd7e8ad5eacf8cc8419a1f9b01f30cb81c18f7a658fde49e8d3_arm64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:02a33bc81310601ebbe26391b472da8f558cbbd0c7ea1400f9cd7c3f44abb0ac_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:4db4e3398f343ef9efecdc1e47ac65d80989add642963869ce754985b75c9bfc_arm64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:be1449ccf241763457d965759214924646ff9d9a4046fe42ccaf1770775afc6c_ppc64le as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:c16ba9bda38878fc3822b7ac128b04a072fdb8b066e8ad76bf435ebc0ec527d9_s390x as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:16f3506332224b30b82a3112e1dd9972cd15f1e6431c22ab3f584424aede986f_s390x as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:6c1672816133d254132da81c88c3f96135911b76dc77d1b12ca0181c54d2937e_arm64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:761c59870f11a3760d1d00b7810c5732b69a1ee57629b6b1dadf312b16695647_amd64 as a component of Red Hat Advanced Cluster Security 4.7
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:cec17c9d59f66b09a840df62b12b42c42e339e1baab53f1032f8c9bf3b1bee24_ppc64le as a component of Red Hat Advanced Cluster Security 4.7
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: The system administrator on the host can manually chmod the directories to not have group or world accessible permissions: ``` chmod 700 /var/lib/containerd chmod 700 /run/containerd/io.containerd.grpc.v1.cri chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim ``` An alternative mitigation would be to run containerd in rootless mode. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.

🔗 References (9)