Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Toolbox Software Security Update

published 8 months ago

Summary

Red Hat has released a security update for the Toolbox software, which is used by system administrators to manage system services. This update fixes a security issue that could allow an attacker to execute arbitrary commands with elevated privileges. Users should update their Toolbox software to the latest version to ensure they have the latest security patches.

What to do

Update redhat toolbox to version 0:0.0.99.5.1-2.el9_4.
Update redhat toolbox-debuginfo to version 0:0.0.99.5.1-2.el9_4.
Update redhat toolbox-debugsource to version 0:0.0.99.5.1-2.el9_4.
Update redhat toolbox-tests to version 0:0.0.99.5.1-2.el9_4.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.4::appstream	redhat	toolbox	< 0:0.0.99.5.1-2.el9_4 Fix: upgrade to 0:0.0.99.5.1-2.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	toolbox-debuginfo	< 0:0.0.99.5.1-2.el9_4 Fix: upgrade to 0:0.0.99.5.1-2.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	toolbox-debugsource	< 0:0.0.99.5.1-2.el9_4 Fix: upgrade to 0:0.0.99.5.1-2.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	toolbox-tests	< 0:0.0.99.5.1-2.el9_4 Fix: upgrade to 0:0.0.99.5.1-2.el9_4

Original advisory text

Red Hat Security Advisory: toolbox security update

References

https://access.redhat.com/errata/RHSA-2026:2520 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418900 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2520.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-65637 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-65637 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-65637 Vendor Advisory
https://github.com/mjuanxd/logrus-dos-poc Third Party Advisory
https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md Third Party Advisory
https://github.com/sirupsen/logrus/issues/1370 Third Party Advisory
https://github.com/sirupsen/logrus/pull/1376 Third Party Advisory
https://github.com/sirupsen/logrus/releases/tag/v1.8.3 Third Party Advisory
https://github.com/sirupsen/logrus/releases/tag/v1.9.1 Third Party Advisory
https://github.com/sirupsen/logrus/releases/tag/v1.9.3 Third Party Advisory
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published12 Feb 2026

Updated6 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2026:2520 · OSV

Track software like this

Free during beta