CriticalFix available
Critical: idm:DL1 security, bug fix, and enhancement update
Type: advisorySources: OSV
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * Fix ipatests for kdcproxy after CVE-2025-59088 fix [rhel-8.10.z] (JIRA:Rocky Linux-129966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgm
- Products
- bind-dyndb-ldap, custodia, ipa, ipa-healthcheck, opendnssec, python-jwcrypto, python-kdcproxy, python-qrcode, python-yubico, pyusb, slapi-nis, softhsm
- Affected versions
- Not specified
- Fixed versions
- 0:0.12-6.module+el8.10.0+2053+a0a9dc19, 0:0.12-6.module+el8.10.0+2054+aa003774, 0:0.4-5.module+el8.10.0+1915+3c70f7d9.1, 0:0.4-5.module+el8.10.0+2094+d7886766.2, 0:0.4-5.module+el8.9.0+1371+ffa84eb9, 0:0.5.0-2.module+el8.10.0+1818+2dfda7a6, 0:0.5.0-2.module+el8.10.0+1819+0aeba2f1, 0:0.6.0-3.module+el8.9.0+1371+ffa84eb9, 0:0.60.0-4.module+el8.9.0+1573+39ab85f4, 0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9, 0:1.0.0-9.1.module+el8.9.0+1372+09f67869, 0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9, 0:1.3.2-9.1.module+el8.9.0+1372+09f67869, 0:11.6-6.module+el8.10.0+1960+1ed527b3, 0:2.1.7-2.module+el8.10.0+1960+1ed527b3, 0:2.6.0-5.module+el8.9.0+1371+ffa84eb9, 0:4.9.13-21.module+el8.10.0+40089+03bf3c1f, 0:4.9.13-21.module+el8.10.0+40090+e6f37a74, 0:5.3-1.module+el8.10.0+1915+3c70f7d9, 0:5.3-1.module+el8.10.0+1916+6bb8cf6b
- CVEs
- CVE-2026-11861, CVE-2026-13097, CVE-2026-18147, CVE-2026-19550, CVE-2026-73197, CVE-2026-73198, CVE-2026-76578, CVE-2026-79678
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:07 UTC · Revision 1
Source evidence
Critical: idm:DL1 security, bug fix, and enhancement update
core-osv · Original sourcePublished 15 Oct 2026, 06:29 UTC
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * Fix ipatests for kdcproxy after CVE-2025-59088 fix [rhel-8.10.z] (JIRA:Rocky Linux-129966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgm
osv:RLSA-2026:83460
bind-dyndb-ldap
Fixed versions: 0:11.6-6.module+el8.10.0+1960+1ed527b3
custodia
Fixed versions: 0:0.6.0-3.module+el8.9.0+1371+ffa84eb9
ipa
Fixed versions: 0:4.9.13-21.module+el8.10.0+40089+03bf3c1f
ipa
Fixed versions: 0:4.9.13-21.module+el8.10.0+40090+e6f37a74
ipa-healthcheck
Fixed versions: 0:0.12-6.module+el8.10.0+2053+a0a9dc19
ipa-healthcheck
Fixed versions: 0:0.12-6.module+el8.10.0+2054+aa003774
opendnssec
Fixed versions: 0:2.1.7-2.module+el8.10.0+1960+1ed527b3
python-jwcrypto
Fixed versions: 0:0.5.0-2.module+el8.10.0+1818+2dfda7a6
python-jwcrypto
Fixed versions: 0:0.5.0-2.module+el8.10.0+1819+0aeba2f1
python-kdcproxy
Fixed versions: 0:0.4-5.module+el8.9.0+1371+ffa84eb9
python-kdcproxy
Fixed versions: 0:0.4-5.module+el8.10.0+1915+3c70f7d9.1
python-kdcproxy
Fixed versions: 0:0.4-5.module+el8.10.0+2094+d7886766.2
python-qrcode
Fixed versions: 0:5.3-1.module+el8.10.0+1915+3c70f7d9
python-qrcode
Fixed versions: 0:5.3-1.module+el8.10.0+1916+6bb8cf6b
python-yubico
Fixed versions: 0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9
python-yubico
Fixed versions: 0:1.3.2-9.1.module+el8.9.0+1372+09f67869
pyusb
Fixed versions: 0:1.0.0-9.1.module+el8.9.0+1372+09f67869
pyusb
Fixed versions: 0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
slapi-nis
Fixed versions: 0:0.60.0-4.module+el8.9.0+1573+39ab85f4
softhsm
Fixed versions: 0:2.6.0-5.module+el8.9.0+1371+ffa84eb9
Complete source record
{
"id": "a8fb103bc064d17e0736170fc2b170d85605fb8f4f21746c521d12336d1b1d1d",
"url": "https://osv.dev/vulnerability/RLSA-2026%3A83460",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Critical: idm:DL1 security, bug fix, and enhancement update",
"summary": "Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * Fix ipatests for kdcproxy after CVE-2025-59088 fix [rhel-8.10.z] (JIRA:Rocky Linux-129966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgm",
"evidence": "osv:RLSA-2026:83460",
"products": [
{
"name": {
"value": "bind-dyndb-ldap",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:11.6-6.module+el8.10.0+1960+1ed527b3",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "custodia",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.6.0-3.module+el8.9.0+1371+ffa84eb9",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ipa",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:4.9.13-21.module+el8.10.0+40089+03bf3c1f",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ipa",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:4.9.13-21.module+el8.10.0+40090+e6f37a74",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ipa-healthcheck",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.12-6.module+el8.10.0+2053+a0a9dc19",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ipa-healthcheck",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.12-6.module+el8.10.0+2054+aa003774",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "opendnssec",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:2.1.7-2.module+el8.10.0+1960+1ed527b3",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-jwcrypto",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.5.0-2.module+el8.10.0+1818+2dfda7a6",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-jwcrypto",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.5.0-2.module+el8.10.0+1819+0aeba2f1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-kdcproxy",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.4-5.module+el8.9.0+1371+ffa84eb9",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-kdcproxy",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.4-5.module+el8.10.0+1915+3c70f7d9.1",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-kdcproxy",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.4-5.module+el8.10.0+2094+d7886766.2",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-qrcode",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:5.3-1.module+el8.10.0+1915+3c70f7d9",
"evidence": "/affected/12/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-qrcode",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:5.3-1.module+el8.10.0+1916+6bb8cf6b",
"evidence": "/affected/13/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-yubico",
"evidence": "/affected/14/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9",
"evidence": "/affected/14/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-yubico",
"evidence": "/affected/15/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:1.3.2-9.1.module+el8.9.0+1372+09f67869",
"evidence": "/affected/15/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pyusb",
"evidence": "/affected/16/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:1.0.0-9.1.module+el8.9.0+1372+09f67869",
"evidence": "/affected/16/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pyusb",
"evidence": "/affected/17/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9",
"evidence": "/affected/17/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "slapi-nis",
"evidence": "/affected/18/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:0.60.0-4.module+el8.9.0+1573+39ab85f4",
"evidence": "/affected/18/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "softhsm",
"evidence": "/affected/19/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:2.6.0-5.module+el8.9.0+1371+ffa84eb9",
"evidence": "/affected/19/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "RLSA-2026:83460",
"aliases": [
"RLSA-2026:83460"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:11.6-6.module+el8.10.0+1960+1ed527b3"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "bind-dyndb-ldap",
"purl": "pkg:rpm/rocky-linux/bind-dyndb-ldap?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.6.0-3.module+el8.9.0+1371+ffa84eb9"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "custodia",
"purl": "pkg:rpm/rocky-linux/custodia?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:4.9.13-21.module+el8.10.0+40089+03bf3c1f"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "ipa",
"purl": "pkg:rpm/rocky-linux/ipa?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:4.9.13-21.module+el8.10.0+40090+e6f37a74"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "ipa",
"purl": "pkg:rpm/rocky-linux/ipa?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.12-6.module+el8.10.0+2053+a0a9dc19"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "ipa-healthcheck",
"purl": "pkg:rpm/rocky-linux/ipa-healthcheck?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.12-6.module+el8.10.0+2054+aa003774"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "ipa-healthcheck",
"purl": "pkg:rpm/rocky-linux/ipa-healthcheck?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2.1.7-2.module+el8.10.0+1960+1ed527b3"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "opendnssec",
"purl": "pkg:rpm/rocky-linux/opendnssec?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.5.0-2.module+el8.10.0+1818+2dfda7a6"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-jwcrypto",
"purl": "pkg:rpm/rocky-linux/python-jwcrypto?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.5.0-2.module+el8.10.0+1819+0aeba2f1"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-jwcrypto",
"purl": "pkg:rpm/rocky-linux/python-jwcrypto?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.4-5.module+el8.9.0+1371+ffa84eb9"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-kdcproxy",
"purl": "pkg:rpm/rocky-linux/python-kdcproxy?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.4-5.module+el8.10.0+1915+3c70f7d9.1"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-kdcproxy",
"purl": "pkg:rpm/rocky-linux/python-kdcproxy?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.4-5.module+el8.10.0+2094+d7886766.2"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-kdcproxy",
"purl": "pkg:rpm/rocky-linux/python-kdcproxy?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:5.3-1.module+el8.10.0+1915+3c70f7d9"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-qrcode",
"purl": "pkg:rpm/rocky-linux/python-qrcode?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:5.3-1.module+el8.10.0+1916+6bb8cf6b"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-qrcode",
"purl": "pkg:rpm/rocky-linux/python-qrcode?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-yubico",
"purl": "pkg:rpm/rocky-linux/python-yubico?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:1.3.2-9.1.module+el8.9.0+1372+09f67869"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "python-yubico",
"purl": "pkg:rpm/rocky-linux/python-yubico?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:1.0.0-9.1.module+el8.9.0+1372+09f67869"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "pyusb",
"purl": "pkg:rpm/rocky-linux/pyusb?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "pyusb",
"purl": "pkg:rpm/rocky-linux/pyusb?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:0.60.0-4.module+el8.9.0+1573+39ab85f4"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "slapi-nis",
"purl": "pkg:rpm/rocky-linux/slapi-nis?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2.6.0-5.module+el8.9.0+1371+ffa84eb9"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "softhsm",
"purl": "pkg:rpm/rocky-linux/softhsm?distro=rocky-linux-8&epoch=0",
"ecosystem": "Rocky Linux:8"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:83460.json"
}
}
],
"modified": "2026-10-15T07:00:02.921467077Z",
"provider": "osv",
"upstream": [
"CVE-2026-11861",
"CVE-2026-13097",
"CVE-2026-18147",
"CVE-2026-19550",
"CVE-2026-73197",
"CVE-2026-73198",
"CVE-2026-76578",
"CVE-2026-79678"
],
"references": [
"https://errata.rockylinux.org/RLSA-2026:83460",
"https://bugzilla.redhat.com/show_bug.cgi?id=2472960",
"https://bugzilla.redhat.com/show_bug.cgi?id=2474697",
"https://bugzilla.redhat.com/show_bug.cgi?id=2487472",
"https://bugzilla.redhat.com/show_bug.cgi?id=2508181",
"https://bugzilla.redhat.com/show_bug.cgi?id=2514019",
"https://bugzilla.redhat.com/show_bug.cgi?id=2515974",
"https://bugzilla.redhat.com/show_bug.cgi?id=2519522",
"https://bugzilla.redhat.com/show_bug.cgi?id=2523356",
"https://access.redhat.com/errata/RHSA-2026:83460"
],
"provider_metadata": {
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:83460"
}
},
"related_cves": [
{
"value": "CVE-2026-11861",
"evidence": "/upstream"
},
{
"value": "CVE-2026-13097",
"evidence": "/upstream"
},
{
"value": "CVE-2026-18147",
"evidence": "/upstream"
},
{
"value": "CVE-2026-19550",
"evidence": "/upstream"
},
{
"value": "CVE-2026-73197",
"evidence": "/upstream"
},
{
"value": "CVE-2026-73198",
"evidence": "/upstream"
},
{
"value": "CVE-2026-76578",
"evidence": "/upstream"
},
{
"value": "CVE-2026-79678",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 321547,
"published_at": "2026-10-15T06:29:02.048659+00:00"
}