Cisco Nexus 9000 unauthenticated root takeover tops a 5-CVE Thursday

A malicious Kubernetes cluster joined via Submariner in cert-auth mode can inject arbitrary ipsec.conf directives, including leftupdown hooks, by stuffing newlines and commands into the CableName field of the CRD. This gives the attacker remote code execution as root on your gateway node. Exploitation requires the attacker to control or compromise a cluster that's already part of your Submariner mesh.

Affected estate

Kubernetes operators using Red Hat Submariner in cert-auth mode for multi-cluster networking

How to check

Check your Submariner deployment mode with 'subctl show all'. Inspect CableName values in Submariner CRDs for unexpected newline characters or ipsec.conf directives.

Included because

remote; root-level code execution; CVSS 9.1; multi-cluster environments common in production

Action

Upgrade Submariner to the patched release. Review and restrict broker-level RBAC so untrusted clusters cannot publish arbitrary CRD fields.

Why it matters

A compromised peer cluster can escalate to root on your gateway node, pivoting into your internal network.

Source

Red Hat Security Advisory

If you run 'rpmbuild -t*' against a tarball whose filename contains shell metacharacters, an attacker can inject arbitrary commands that execute as the build user. This is most dangerous in CI/CD pipelines that automatically ingest externally supplied artifact names without sanitizing them. If your build users run with elevated privileges, the blast radius gets worse fast.

Affected estate

Linux sysadmins and DevOps engineers running rpmbuild in automated CI/CD pipelines that process externally supplied tarballs

How to check

Run 'rpm --version' to confirm the installed version. Search CI pipeline configs for 'rpmbuild -ta' or 'rpmbuild -tb' invocations that accept external input for the tarball path.

Included because

command injection; common tool in Linux build environments; CI/CD attack surface; CVSS 7.8

Action

Patch rpmbuild via your distro's package manager. Sanitize all external filenames before passing them to rpmbuild.

Why it matters

Command injection in build pipelines can lead to supply chain compromise, data theft, or lateral movement from the build environment.

Source

Red Hat Security Advisory

A crafted Authorization or WWW-Authenticate header with tricky whitespace can crash any application using GStreamer's RTSP library. On an RTSP server with authentication enabled, a single unauthenticated request triggers the crash. On RTSP clients, a malicious server can trigger the same crash. This is denial of service only, with no code execution confirmed.

Affected estate

Anyone running GStreamer-based RTSP servers or clients, including surveillance, media streaming, and video pipeline systems on Linux

How to check

Run 'gst-inspect-1.0 --version' or check your package manager for gst-rtsp-server and gst-plugins-base versions. Confirm whether Digest authentication is configured on your RTSP endpoints.

Included because

unauthenticated; remote crash; CVSS 7.5; common in surveillance and media infrastructure

Action

Update GStreamer RTSP libraries to the fixed version. If patching is delayed and you can tolerate it, disable Digest authentication temporarily.

Why it matters

A single malformed request can crash your RTSP server, taking down video feeds or surveillance systems without any authentication.

Source

Red Hat / GStreamer upstream advisory

Sending a stream of crafted HTTP packets to affected Cisco desk and IP phones causes a memory leak that eventually kills the device. You'll need a manual reboot to recover. The good news: the phone must be registered to Unified CM and have Web Access enabled, which is off by default. If you turned Web Access on, you're exposed.

Affected estate

UC engineers managing Cisco Desk Phone 9800, IP Phone 7800/8800, or Video Phone 8875 with Web Access enabled and registered to Unified CM

How to check

In Unified CM Administration, check the Phone Configuration page for Web Access status. Alternatively, try browsing to the phone's IP on HTTP. If you get a response, Web Access is on.

Included because

unauthenticated; remote DoS; CVSS 7.5; common enterprise VoIP equipment; requires non-default config

Action

Update the phone firmware to the patched SIP software version. If you can't patch right away, disable Web Access on affected phones through Unified CM.

Why it matters

A sustained attack can render phones unresponsive until manually rebooted, disrupting voice communications across your environment.

Source

Cisco Security Advisory