RHSA-2026:60354: Important: rhc security update
rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.Security Fix(es): golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rhcto a version that resolves this vulnerability.Fixed in 0.2.2-1.el9_2.4 - Upgrade
Upgrade
redhat/rhc-debuginfoto a version that resolves this vulnerability.Fixed in 0.2.2-1.el9_2.4 - Upgrade
Upgrade
redhat/rhc-debugsourceto a version that resolves this vulnerability.Fixed in 0.2.2-1.el9_2.4 - Upgrade
Upgrade
redhat/rhcto a version that resolves this vulnerability.Fixed in 0.2.2-1.el9_2.4.aa - Upgrade
Upgrade
redhat/rhc-debuginfoto a version that resolves this vulnerability.Fixed in 0.2.2-1.el9_2.4.aa - Upgrade
Upgrade
redhat/rhc-debugsourceto a version that resolves this vulnerability.Fixed in 0.2.2-1.el9_2.4.aa - Upgrade
Upgrade
rhcto a version that resolves this vulnerability.Patch rhc security update
Event History
Frequently Asked Questions
Which packages are covered by this update?
The advisory lists redhat/rhc, redhat/rhc-debuginfo, and redhat/rhc-debugsource.
Does the advisory specify the fixed package versions?
No fixed package version numbers are provided in the available advisory data.