VDB
RHSA-2026:60018
RHSA-2026:60018
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | skopeo-2:1.16.1-7.rhaos4.17.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.16.1-7.rhaos4.17.el9.aarch64, 1.16.1-7.rhaos4.17.el9.aarch64, 1.16.1-7.rhaos4.17.el9.aarch64 |
| Red Hat | containernetworking-plugins-1:1.4.0-10.rhaos4.17.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | 1.4.0-10.rhaos4.17.el8.ppc64le, 1.4.0-10.rhaos4.17.el8.ppc64le, 1.4.0-10.rhaos4.17.el8.ppc64le |
| Red Hat | skopeo-tests-2:1.16.1-7.rhaos4.17.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.16.1-7.rhaos4.17.el8.aarch64, 1.16.1-7.rhaos4.17.el8.aarch64, 1.16.1-7.rhaos4.17.el8.aarch64 |
| Red Hat | containernetworking-plugins-debugsource-1:1.4.0-10.rhaos4.17.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.4.0-10.rhaos4.17.el8.aarch64, 1.4.0-10.rhaos4.17.el8.aarch64, 1.4.0-10.rhaos4.17.el8.aarch64 |
| Red Hat | openshift-clients-0:4.17.0-202608201812.p2.g7189593.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608201812.p2.g7189593.assembly.stream.el8.s390x, 4.17.0-202608201812.p2.g7189593.assembly.stream.el8.s390x, 4.17.0-202608201812.p2.g7189593.assembly.stream.el8.s390x |
| Red Hat | ose-aws-ecr-image-credential-provider-0:4.17.0-202608122146.p2.g144bace.assembly.stream.el9.src as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608122146.p2.g144bace.assembly.stream.el9.src, 4.17.0-202608122146.p2.g144bace.assembly.stream.el9.src, 4.17.0-202608122146.p2.g144bace.assembly.stream.el9.src |
| Red Hat | openshift-kube-apiserver-0:4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.s390x, 4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.s390x, 4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.s390x |
| Red Hat | skopeo-tests-2:1.16.1-7.rhaos4.17.el9.s390x as a component of Red Hat OpenShift Container Platform 4.17 | 1.16.1-7.rhaos4.17.el9.s390x, 1.16.1-7.rhaos4.17.el9.s390x, 1.16.1-7.rhaos4.17.el9.s390x |
| Red Hat | ose-gcp-gcr-image-credential-provider-0:4.17.0-202608122146.p2.g8ce997d.assembly.stream.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608122146.p2.g8ce997d.assembly.stream.el9.ppc64le, 4.17.0-202608122146.p2.g8ce997d.assembly.stream.el9.ppc64le, 4.17.0-202608122146.p2.g8ce997d.assembly.stream.el9.ppc64le |
| Red Hat | ose-aws-ecr-image-credential-provider-0:4.17.0-202608122146.p2.g144bace.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608122146.p2.g144bace.assembly.stream.el8.s390x, 4.17.0-202608122146.p2.g144bace.assembly.stream.el8.s390x, 4.17.0-202608122146.p2.g144bace.assembly.stream.el8.s390x |
| Red Hat | containernetworking-plugins-debuginfo-1:1.4.0-10.rhaos4.17.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.4.0-10.rhaos4.17.el8.x86, 1.4.0-10.rhaos4.17.el8.x86, 1.4.0-10.rhaos4.17.el8.x86 |
| Red Hat | runc-4:1.2.9-6.rhaos4.17.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.2.9-6.rhaos4.17.el8.aarch64, 1.2.9-6.rhaos4.17.el8.aarch64, 1.2.9-6.rhaos4.17.el8.aarch64 |
| Red Hat | cri-tools-debuginfo-0:1.30.0-9.el9.s390x as a component of Red Hat OpenShift Container Platform 4.17 | 1.30.0-9.el9.s390x, 1.30.0-9.el9.s390x, 1.30.0-9.el9.s390x |
| Red Hat | skopeo-debuginfo-2:1.16.1-7.rhaos4.17.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.16.1-7.rhaos4.17.el9.x86, 1.16.1-7.rhaos4.17.el9.x86, 1.16.1-7.rhaos4.17.el9.x86 |
| Red Hat | runc-4:1.2.9-6.rhaos4.17.el8.s390x as a component of Red Hat OpenShift Container Platform 4.17 | 1.2.9-6.rhaos4.17.el8.s390x, 1.2.9-6.rhaos4.17.el8.s390x, 1.2.9-6.rhaos4.17.el8.s390x |
| Red Hat | skopeo-debugsource-2:1.16.1-7.rhaos4.17.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.16.1-7.rhaos4.17.el9.aarch64, 1.16.1-7.rhaos4.17.el9.aarch64, 1.16.1-7.rhaos4.17.el9.aarch64 |
| Red Hat | ose-azure-acr-image-credential-provider-0:4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el9.src as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el9.src, 4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el9.src, 4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el9.src |
| Red Hat | skopeo-debuginfo-2:1.16.1-7.rhaos4.17.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.17 | 1.16.1-7.rhaos4.17.el9.aarch64, 1.16.1-7.rhaos4.17.el9.aarch64, 1.16.1-7.rhaos4.17.el9.aarch64 |
| Red Hat | openshift-kube-apiserver-0:4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.ppc64le, 4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.ppc64le, 4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8.ppc64le |
| Red Hat | ose-aws-ecr-image-credential-provider-0:4.17.0-202608122146.p2.g144bace.assembly.stream.el9.s390x as a component of Red Hat OpenShift Container Platform 4.17 | 4.17.0-202608122146.p2.g144bace.assembly.stream.el9.s390x, 4.17.0-202608122146.p2.g144bace.assembly.stream.el9.s390x, 4.17.0-202608122146.p2.g144bace.assembly.stream.el9.s390x |
…and 202 more
Timeline
- Sep 3, 2026 CVE Published
- Oct 9, 2026 CVE Updated
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Distribution Patch
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
- Oct 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:60018 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2437111 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2445356 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467809 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60018.json advisory
- https://access.redhat.com/security/cve/CVE-2025-68121 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-68121 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-68121 advisory
- https://go.dev/cl/737700 advisory
- https://go.dev/issue/77217 advisory
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk advisory
- https://pkg.go.dev/vuln/GO-2026-4337 advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25679 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 advisory
…and 37 more