{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/red-hat-enterprise-linux-8/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8,"id":"CVE-2026-14476"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SSSD AD GPO provider","Red Hat Enterprise Linux 10","Red Hat Enterprise Linux 7","Red Hat Enterprise Linux 8","Red Hat Enterprise Linux 9","Red Hat OpenShift Container Platform 4"],"_cs_severities":["high"],"_cs_tags":["path-traversal","privilege-escalation","authentication-bypass","kerberos","linux","red-hat","sssd","cve"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eA critical path traversal vulnerability, tracked as CVE-2026-14476, has been identified in the System Security Services Daemon (SSSD) AD GPO provider. This flaw resides within the \u003ccode\u003ead_gpo_extract_smb_components()\u003c/code\u003e function, which fails to properly sanitize \u003ccode\u003e..\u003c/code\u003e sequences embedded within the \u003ccode\u003egPCFileSysPath\u003c/code\u003e LDAP attribute. This oversight enables an attacker, who has already secured Active Directory GPO management privileges, to craft a malicious attribute that directs file writes outside the intended GPO cache directory. Exploitation results in the ability to write arbitrary files as the \u003ccode\u003eroot\u003c/code\u003e user on affected systems. Specifically, on default Red Hat Enterprise Linux (RHEL) configurations with SELinux in enforcing mode, this vulnerability can be leveraged to inject malicious Kerberos configuration, ultimately leading to an authentication bypass, compromising system integrity and access controls.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains or already possesses valid Active Directory GPO management credentials and access.\u003c/li\u003e\n\u003cli\u003eUsing their GPO management privileges, the attacker modifies the \u003ccode\u003egPCFileSysPath\u003c/code\u003e LDAP attribute to include \u003ccode\u003e..\u003c/code\u003e path traversal sequences.\u003c/li\u003e\n\u003cli\u003eThe crafted \u003ccode\u003egPCFileSysPath\u003c/code\u003e attribute is designed to point to a sensitive system directory outside the normal GPO cache on the target SSSD-managed RHEL system.\u003c/li\u003e\n\u003cli\u003eWhen SSSD's \u003ccode\u003ead_gpo_extract_smb_components()\u003c/code\u003e function processes this attribute, it inadequately sanitizes the \u003ccode\u003e..\u003c/code\u003e sequences, misinterpreting the attacker's intended path.\u003c/li\u003e\n\u003cli\u003eThis allows the attacker to write arbitrary files with \u003ccode\u003eroot\u003c/code\u003e privileges to a chosen location on the affected RHEL system, bypassing normal file system permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker injects a malicious Kerberos configuration file (e.g., within \u003ccode\u003e/etc/krb5.conf.d/\u003c/code\u003e or \u003ccode\u003e/etc/krb5.conf\u003c/code\u003e) into a directory that is processed by the system's Kerberos client.\u003c/li\u003e\n\u003cli\u003eThe injected configuration manipulates Kerberos authentication parameters, potentially redirecting authentication requests or enabling compromise of Kerberos tickets.\u003c/li\u003e\n\u003cli\u003eThis manipulation leads to an authentication bypass, granting the attacker unauthorized access or elevated privileges on the SSSD-managed RHEL system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-14476 grants an authenticated attacker (with AD GPO management access) the ability to achieve arbitrary file write as root on targeted Red Hat Enterprise Linux systems. This level of access allows for critical system compromise, including the injection of malicious Kerberos configurations that can lead to a full authentication bypass. The consequence is a complete compromise of system integrity, confidentiality, and availability, enabling unauthorized access to sensitive data and critical system functions. Organizations relying on SSSD for Active Directory integration on RHEL are at risk, with potential for widespread compromise if AD GPO management systems are breached.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-14476 by applying the latest security updates provided by Red Hat for SSSD to all affected Red Hat Enterprise Linux and OpenShift Container Platform installations.\u003c/li\u003e\n\u003cli\u003eReview and restrict Active Directory GPO management access to only necessary administrative accounts, following the principle of least privilege.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual file creation or modification events in sensitive system directories (e.g., \u003ccode\u003e/etc/krb5.conf\u003c/code\u003e, \u003ccode\u003e/etc/krb5.conf.d/\u003c/code\u003e) on SSSD-managed RHEL systems.\u003c/li\u003e\n\u003cli\u003eImplement host-based intrusion detection systems to alert on unexpected changes to Kerberos configuration files or attempts to write files outside standard GPO cache locations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-07T10:19:46Z","date_published":"2026-07-07T10:19:46Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14476-sssd-path-traversal/","summary":"A path traversal vulnerability (CVE-2026-14476) in SSSD's Active Directory Group Policy Object (AD GPO) provider allows an authenticated attacker with AD GPO management access to write arbitrary files outside the GPO cache directory with root privileges, leading to Kerberos configuration injection and potential authentication bypass on Red Hat Enterprise Linux systems.","title":"CVE-2026-14476: SSSD AD GPO Provider Path Traversal to Root File Write and Authentication Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14476-sssd-path-traversal/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-58380"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GIMP","Red Hat Enterprise Linux 6","Red Hat Enterprise Linux 7","Red Hat Enterprise Linux 8","Red Hat Enterprise Linux 9"],"_cs_severities":["high"],"_cs_tags":["vulnerability","memory-corruption","buffer-overflow","GIMP","linux"],"_cs_type":"threat","_cs_vendors":["GNOME","Red Hat"],"content_html":"\u003cp\u003eCVE-2026-58380 details a critical vulnerability discovered in GIMP's PNM (Portable Anymap) image file format parser. The flaw resides within the \u003ccode\u003epnmscanner_gettoken()\u003c/code\u003e function, where an off-by-one error during a loop boundary check causes a null terminator to be written one byte beyond the intended boundary of a stack-allocated buffer. This memory corruption is triggered when GIMP attempts to parse a specially crafted PNM file. While not yet observed in active exploitation, successful exploitation could lead to application instability and denial of service due to crashes, or, more severely, arbitrary code execution, granting an attacker control over the compromised system. This vulnerability affects various GIMP versions, including those shipped with Red Hat Enterprise Linux distributions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious PNM image file specifically designed to exploit the off-by-one error in GIMP's \u003ccode\u003epnmscanner_gettoken()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe malicious PNM file is delivered to a victim through common vectors such as email attachments, malicious websites, or untrusted file shares.\u003c/li\u003e\n\u003cli\u003eThe victim opens the specially crafted PNM file using the vulnerable GIMP application.\u003c/li\u003e\n\u003cli\u003eDuring the file parsing process, the \u003ccode\u003epnmscanner_gettoken()\u003c/code\u003e function attempts to process the malicious input.\u003c/li\u003e\n\u003cli\u003eThe off-by-one error causes a null byte to be written past the end of a stack buffer, corrupting adjacent memory.\u003c/li\u003e\n\u003cli\u003eThis memory corruption disrupts program execution flow, leading to either an immediate application crash (denial of service) or, under controlled conditions, enables arbitrary code execution on the victim's system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability, CVE-2026-58380, carries a CVSS v3.1 Base Score of 7.3 (High), indicating significant potential impact. If successfully exploited, systems running vulnerable versions of GIMP could suffer from denial of service, where the application crashes, leading to loss of productivity. More critically, an attacker could achieve arbitrary code execution, allowing them to install malware, exfiltrate data, or gain full control over the compromised system. While there are no reports of in-the-wild exploitation, the widespread use of GIMP, particularly on Linux distributions like Red Hat Enterprise Linux, makes this a high-risk vulnerability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply available patches for CVE-2026-58380 immediately to all GIMP installations, particularly on Red Hat Enterprise Linux systems, by referring to the official Red Hat security advisory at \u003ccode\u003ehttps://access.redhat.com/security/cve/CVE-2026-58380\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor Red Hat security channels for updates to affected products as detailed in the Red Hat advisory and apply them promptly.\u003c/li\u003e\n\u003cli\u003eImplement user awareness training regarding the risks associated with opening untrusted image files, especially those in less common formats like PNM.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-06T15:25:56Z","date_published":"2026-07-06T15:25:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-58380-gimp-pnm-parser-vulnerability/","summary":"A high-severity off-by-one error, CVE-2026-58380, in GIMP's PNM file format parser (specifically the `pnmscanner_gettoken()` function) allows an attacker to corrupt memory by crafting a malicious PNM file, potentially leading to denial of service or arbitrary code execution when the file is opened.","title":"CVE-2026-58380: GIMP PNM Parser Off-by-One Error Leads to RCE","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-58380-gimp-pnm-parser-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Red Hat Enterprise Linux 8","version":"https://jsonfeed.org/version/1.1"}