Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
Red Hat hardened images may weaken container security
published 20 days ago
Summary
The Red Hat packages cargo, clippy, rust, rust-analyzer, and rust-debugger-common included in hardened container images have been updated to correct bugs that could let an attacker gain higher privileges or bypass restrictions. These issues could expose your container workloads to risk. Install the latest Red Hat update for these packages to maintain the intended security hardening.
What to do
- Update redhat cargo to version 0:1.99.0-1.hum1.
- Update redhat clippy to version 0:1.99.0-1.hum1.
- Update redhat rust to version 0:1.99.0-1.hum1.
- Update redhat rust-analyzer to version 0:1.99.0-1.hum1.
- Update redhat rust-debugger-common to version 0:1.99.0-1.hum1.
- Update redhat rust-doc to version 0:1.99.0-1.hum1.
- Update redhat rust-gdb to version 0:1.99.0-1.hum1.
- Update redhat rust-lldb to version 0:1.99.0-1.hum1.
- Update redhat rust-src to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-aarch64-unknown-none-softfloat to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-aarch64-unknown-uefi to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-i686-pc-windows-gnu to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-wasm32-unknown-unknown to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-wasm32-wasip1 to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-x86_64-pc-windows-gnu to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-x86_64-unknown-none to version 0:1.99.0-1.hum1.
- Update redhat rust-std-static-x86_64-unknown-uefi to version 0:1.99.0-1.hum1.
- Update redhat rustfmt to version 0:1.99.0-1.hum1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:hummingbird:1 | redhat | cargo |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | clippy |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-analyzer |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-debugger-common |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-doc |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-gdb |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-lldb |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-src |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-aarch64-unknown-none-softfloat |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-aarch64-unknown-uefi |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-i686-pc-windows-gnu |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-wasm32-unknown-unknown |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-wasm32-wasip1 |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-x86_64-pc-windows-gnu |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-x86_64-unknown-none |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-x86_64-unknown-uefi |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
| Red Hat:hummingbird:1 | redhat | rustfmt |
< 0:1.99.0-1.hum1 Fix: upgrade to 0:1.99.0-1.hum1
|
Original advisory text
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
References
- https://access.redhat.com/errata/RHSA-2026:80349 Vendor Advisory
- https://images.redhat.com/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-92392 Third Party Advisory
- https://access.redhat.com/security/updates/classification/ Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80349.... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2548642 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-92392 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-92392 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published15 Oct 2026
Updated16 Oct 2026
First seen16 Oct 2026
Sources
RHSA-2026:80349 · OSV
Track software like this
Free during beta