Enterprise Linux Ai vulnerabilities
3 known vulnerabilities in Enterprise Linux Ai from Red Hat. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 6.5 Medium severity
Kludex Starlette HTTP Request/Response Smuggling Exploited
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt
- 8.8 High severity
Red Hat Enterprise Linux AI (RHEL AI) 3: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/gene
- 7.1 High severity
Red Hat Enterprise Linux AI (RHEL AI) 3: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on th