{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for Red Hat Hardened Images RPMs is now available.", "title": "Topic" }, { "category": "general", "text": "This update includes the following RPMs:\n\ngo-fdo-server:\n * go-fdo-server-1.0.1-0.2.hum1 (aarch64, x86_64)\n * go-fdo-server-manufacturer-1.0.1-0.2.hum1 (noarch)\n * go-fdo-server-owner-1.0.1-0.2.hum1 (noarch)\n * go-fdo-server-rendezvous-1.0.1-0.2.hum1 (noarch)\n * go-fdo-server-1.0.1-0.2.hum1.src (src)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2026:15856", "url": "https://access.redhat.com/errata/RHSA-2026:15856" }, { "category": "external", "summary": "https://images.redhat.com/", "url": "https://images.redhat.com/" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-41889", "url": "https://access.redhat.com/security/cve/CVE-2026-41889" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_15856.json" } ], "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update", "tracking": { "current_release_date": "2026-06-27T19:50:30+00:00", "generator": { "date": "2026-06-27T19:50:30+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "RHSA-2026:15856", "initial_release_date": "2026-05-09T14:50:22+00:00", "revision_history": [ { "date": "2026-05-09T14:50:22+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-05-19T15:46:04+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-06-27T19:50:30+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Hardened Images", "product": { "name": "Red Hat Hardened Images", "product_id": "Red Hat Hardened Images", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_family", "name": "Red Hat Hardened Images" }, { "branches": [ { "category": "product_version", "name": "go-fdo-server-main@aarch64", "product": { "name": "go-fdo-server-main@aarch64", "product_id": "go-fdo-server-main@aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-fdo-server@1.0.1-0.2.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "go-fdo-server-main@src", "product": { "name": "go-fdo-server-main@src", "product_id": "go-fdo-server-main@src", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-fdo-server@1.0.1-0.2.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "go-fdo-server-main@x86_64", "product": { "name": "go-fdo-server-main@x86_64", "product_id": "go-fdo-server-main@x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-fdo-server@1.0.1-0.2.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "go-fdo-server-main@noarch", "product": { "name": "go-fdo-server-main@noarch", "product_id": "go-fdo-server-main@noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-fdo-server-manufacturer@1.0.1-0.2.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "go-fdo-server-main@aarch64 as a component of Red Hat Hardened Images", "product_id": "Red Hat Hardened Images:go-fdo-server-main@aarch64" }, "product_reference": "go-fdo-server-main@aarch64", "relates_to_product_reference": "Red Hat Hardened Images" }, { "category": "default_component_of", "full_product_name": { "name": "go-fdo-server-main@noarch as a component of Red Hat Hardened Images", "product_id": "Red Hat Hardened Images:go-fdo-server-main@noarch" }, "product_reference": "go-fdo-server-main@noarch", "relates_to_product_reference": "Red Hat Hardened Images" }, { "category": "default_component_of", "full_product_name": { "name": "go-fdo-server-main@src as a component of Red Hat Hardened Images", "product_id": "Red Hat Hardened Images:go-fdo-server-main@src" }, "product_reference": "go-fdo-server-main@src", "relates_to_product_reference": "Red Hat Hardened Images" }, { "category": "default_component_of", "full_product_name": { "name": "go-fdo-server-main@x86_64 as a component of Red Hat Hardened Images", "product_id": "Red Hat Hardened Images:go-fdo-server-main@x86_64" }, "product_reference": "go-fdo-server-main@x86_64", "relates_to_product_reference": "Red Hat Hardened Images" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-41889", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "discovery_date": "2026-05-08T17:01:09.435496+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2468307" } ], "notes": [ { "category": "description", "text": "A flaw was found in pgx, a PostgreSQL driver and toolkit for Go. This SQL injection vulnerability can occur when using the non-default simple protocol, a dollar-quoted string literal in the SQL query, and when that string literal contains text interpreted as a placeholder with an attacker-controlled value. An attacker could potentially manipulate SQL queries, leading to a low impact on data integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has rated this flaw as Moderate because the SQL injection vulnerability in pgx can only be triggered when the non-default simple protocol is used in conjunction with specific query constructions involving PostgreSQL dollar-quoted string literals. Successful exploitation requires multiple uncommon preconditions, including attacker control of placeholder values within affected queries. As the issue is limited to particular application usage patterns and does not affect default pgx configurations, the overall risk is reduced despite the potential for query manipulation in vulnerable applications.The strongest argument for a Moderate rating is that this is not a generic SQL injection affecting all pgx users; it is a narrowly scoped flaw requiring a non-default mode and specific application behavior", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Hardened Images:go-fdo-server-main@aarch64", "Red Hat Hardened Images:go-fdo-server-main@noarch", "Red Hat Hardened Images:go-fdo-server-main@src", "Red Hat Hardened Images:go-fdo-server-main@x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-41889" }, { "category": "external", "summary": "RHBZ#2468307", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468307" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41889", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41889" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41889", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41889" }, { "category": "external", "summary": "https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da", "url": "https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da" }, { "category": "external", "summary": "https://github.com/jackc/pgx/releases/tag/v5.9.2", "url": "https://github.com/jackc/pgx/releases/tag/v5.9.2" }, { "category": "external", "summary": "https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx", "url": "https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx" } ], "release_date": "2026-05-08T15:53:00.251000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-05-09T14:50:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "product_ids": [ "Red Hat Hardened Images:go-fdo-server-main@aarch64", "Red Hat Hardened Images:go-fdo-server-main@noarch", "Red Hat Hardened Images:go-fdo-server-main@src", "Red Hat Hardened Images:go-fdo-server-main@x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:15856" }, { "category": "workaround", "details": "Avoid using the non-default simple protocol in applications that use the pgx PostgreSQL driver for Go. The vulnerability is contingent on this non-default protocol and specific SQL query constructs. Configuring applications to use the default extended protocol prevents this issue. If the simple protocol is necessary, ensure that dollar-quoted string literals do not contain attacker-controlled placeholder values.", "product_ids": [ "Red Hat Hardened Images:go-fdo-server-main@aarch64", "Red Hat Hardened Images:go-fdo-server-main@noarch", "Red Hat Hardened Images:go-fdo-server-main@src", "Red Hat Hardened Images:go-fdo-server-main@x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Hardened Images:go-fdo-server-main@aarch64", "Red Hat Hardened Images:go-fdo-server-main@noarch", "Red Hat Hardened Images:go-fdo-server-main@src", "Red Hat Hardened Images:go-fdo-server-main@x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions" } ] }