Red Hat Hardened Images Updates Address 24 Vulnerabilities
Tech GuruQuick Answer
The ten linked Red Hat Hardened Images advisories enumerate corrected RPM builds for seven component families. Their structured vulnerability lists contain 24 unique CVEs. These records do not provide container-image digests: update or rebuild the relevant image using its supported fixed RPMs, then record and verify the resulting deployment digest separately.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Red Hat Hardened Images for Apache HTTP Server, Podman, Caddy, Python, Grafana, OpenTofu, and FreeType, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Hardened Images for Apache HTTP Server, Podman, Caddy, Python, Grafana, OpenTofu, and FreeType |
|---|---|
| Advisory | RHSA-2026:74858 / RHSA-2026:74861 / RHSA-2026:74865 / RHSA-2026:74868 / RHSA-2026:74869 / RHSA-2026:74871 / RHSA-2026:74872 / RHSA-2026:74922 / RHSA-2026:74948 / RHSA-2026:74952 |
| CVEs | CVE-2026-101903, CVE-2026-12345, CVE-2026-17084, CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56449, CVE-2026-58415, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79705, CVE-2026-79768, CVE-2026-81871, CVE-2026-93546, CVE-2026-93981, CVE-2026-94603, CVE-2026-95512 |
| Authoritative release date | 2026-10-02 09:04:53 UTC |
| Authority revision date | Latest current_release_date in the checked advisory set: 2026-10-02T17:41:12+00:00. Individual advisories may have earlier revisions. |
| Affected versions | The matching Red Hat Hardened Images RPM builds and architectures before the listed corrected builds. No container digest is enumerated by these ten CSAF records. |
| Fixed version | httpd 2.4.69-1.hum1; podman 6.1.3-1.hum1; caddy 2.11.6-0.1.hum1; python3.10 3.10.22-1.hum1; python3.12 3.12.15-1.hum1; grafana12.4 12.4.12-0.3.hum1; grafana13.1 13.1.6-0.6.hum1; grafana13.2 13.2.1-0.9.hum1; opentofu1.12 1.12.7-0.1.hum1; freetype 2.14.3-2.1.hum1. Match installed subpackages and architecture to each advisory. |
| CVSS base score | 3.7–8.6 (official CVSS v3.1 range) |
| CVSS severity | Low to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The mapping is httpd: 74858; Podman: 74861; Caddy: 74865; Python 3.10: 74868; Grafana 13.1: 74869; Grafana 12.4: 74871; Grafana 13.2: 74872; Python 3.12: 74922; OpenTofu 1.12: 74948; FreeType: 74952 (all RHSA-2026). CVE scope differs by component and branch. RHSA-2026:74871 also names CVE-2026-93450 in its prose but omits it from the structured vulnerability list; that unresolved discrepancy is outside the 24-item structured count below.
What To Validate Now
- Inventory. Locate Red Hat Hardened Images for Apache HTTP Server, Podman, Caddy, Python, Grafana, OpenTofu, and FreeType deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match entitlement, product stream, architecture, source package or image repository, and each advisory's product status. Do not apply one branch's build or digest to another branch.
- Remediate. Use the supported Hardened Images package/build workflow for the actual component and branch. Rebuild derived images and redeploy their resulting verified digest; do not assume a mutable tag changed every running container. Keep Python and Grafana branches aligned with application compatibility rather than switching branches to match another advisory.
- Validate. Verify the fixed RPMs in the resulting runtime artifact and its running digest. Choose relevant benign checks: HTTP/TLS routes for web servers, an authorized container launch for Podman, application tests for Python, dashboards/data-source access for Grafana, a non-applying infrastructure plan for OpenTofu, or representative font rendering for FreeType. Do not apply infrastructure changes merely to prove an update.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve configuration, state and prior deployment references under the normal recovery policy. A component version does not verify an image signature or prove every listed CVE affects the application. The Grafana summary/list discrepancy needs Red Hat clarification; no packages, images or infrastructure were changed here.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- RHSA-2026:74858
- RHSA-2026:74861
- RHSA-2026:74865
- RHSA-2026:74868
- RHSA-2026:74869
- RHSA-2026:74871
- RHSA-2026:74872
- RHSA-2026:74922
- RHSA-2026:74948
- RHSA-2026:74952
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
