Red Hat Product Errata RHSA-2026:41948 - Security Advisory Issued: 2026-07-20 Updated: 2026-07-20 RHSA-2026:41948 - Security Advisory Overview Updated Packages Synopsis Important: javapackages-tools:201801 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the javapackages-tools:201801 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The javapackages-tools packages provide macros and scripts to support Java packaging. Security Fix(es): org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x Fixes BZ - 2451409 - CVE-2025-67030 org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVEs CVE-2025-67030 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat CodeReady Linux Builder for x86_64 8 SRPM ant-1.10.5-1.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 2c842c8183955dfbfea5bd8b3d81d995cf12d4b50a6738959a924925de9d76fe ant-contrib-1.0-0.32.b3.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 9e7537554bed1f551678df43a50787c5cbe4f87c0cb9f1452c7d820f3da304d9 antlr-2.7.7-56.module+el8.10.0+23274+27840b45.src.rpm SHA-256: ce24d52af85cc2e884f6e9e523d38be9b86974b62d93b7c36043a3c68bc74a58 aopalliance-1.0-17.module+el8.10.0+23274+27840b45.src.rpm SHA-256: a5cad5a3b7323cc6cd71972ce426871f01f99c8f4a43550d37182e231423fca9 apache-commons-beanutils-1.9.3-5.module+el8.10.0+23274+27840b45.src.rpm SHA-256: bdf3f0e5847ec2d98e08023957d6b87e0204fc90e31d85112aedeee4f696a76f apache-commons-cli-1.4-4.module+el8.10.0+23274+27840b45.src.rpm SHA-256: dfa8cfc75f74b9847e3a3d2df7e60af97c57fc257858141438fcbf7dd220e517 apache-commons-codec-1.11-3.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 98f4f51ead7ca9c5aabc1ffc38c171b16c65e0e7a313412a758b083be5906bf0 apache-commons-collections-3.2.2-10.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 4424effb9d9b0334c15cb742bbf32e995a71a3c350c79c9d6d311b28f8d490c9 apache-commons-compress-1.18-1.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 37c70c8621ba170631c15fd3c8103e7ce3c12580dea9a4244ec77fecb0ed7d38 apache-commons-exec-1.3-8.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 19ce3ca78b4bb9414d166aec1b1f287b343f022a3d34945f3e461566278853a8 apache-commons-io-2.6-3.module+el8.10.0+23274+27840b45.src.rpm SHA-256: daf421e3db16f7c659e355e6bca28ab69eef5f05467709e40496008173053492 apache-commons-jxpath-1.3-29.module+el8.10.0+23274+27840b45.src.rpm SHA-256: bb5d9d62c2d10ed39b822118c3019909de5368d63b5983d5e3f41507f295785f apache-commons-lang-2.6-21.module+el8.10.0+23274+27840b45.src.rpm SHA-256: ff07058e2b5af36a459ffe68971acc79492bd0bc5efa6be9a74eaa60b0203878 apache-commons-lang3-3.7-3.module+el8.10.0+23274+27840b45.src.rpm SHA-256: f23923b7071fa634913cb362deb763d907cfcb0b62fbafc3bf3ca6d0ef2e6558 apache-commons-logging-1.2-13.module+el8.10.0+23274+27840b45.src.rpm SHA-256: f185af764dd8df6dde05aa67f7084dcae1a8ee73cf80da1e239b476adb041ba4 apache-commons-net-3.6-3.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 607152ab2b478f7d526e44b4d7eb71725a0eae47e51ad37cbed47e0d66518bdc apache-commons-parent-43-2.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 5c1625bf0a4a29e7c78668a05e676f5ae5bda8b0023f3c25ec4f139c11399102 apache-ivy-2.4.0-14.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 972b5332ea72f5bec820e799d11080d940cf6d5643913579d9ac3109e7c4913d apache-parent-19-2.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 0e99c6cf0fb893eaa13ec5734779d2377d74ddf664dbd6bfe09bd2e1266e3ce5 apache-resource-bundles-2-20.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 2bee1ca030e5bc79c243d73d4da47dd5f5d71ad5e139ce6fc8c09a843ef729c8 aqute-bnd-3.5.0-4.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 178668c896d4df377209434348e62090fa949320a8da03a1d19d3aefa7f668ab assertj-core-3.8.0-2.module+el8.10.0+23274+27840b45.src.rpm SHA-256: ab34a3a93b0798f65af768a6e6ad77d79aa53a1c362ad4b22cfbf6c0d54dc434 atinject-1-28.20100611svn86.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 7b58def5eb8e3825bc10b81f8df7c2ac1c7c319cdf138069f0cd7f0b5256bc81 bcel-6.2-2.module+el8.10.0+23274+27840b45.src.rpm SHA-256: bc80940acd8858bac4e1d4f483d4e0ef9cc70efd00e97d60be6e2bc4269c71fc beust-jcommander-1.71-5.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 869bf67613177a9f1b5729c908fbb92f87e98bf804f442f2a8dfdc0124326b68 bsf-2.4.0-30.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 8a8720ad5c26275f481442b025d41230c6fb1aa3cb106d8f52c31316063bad05 bsh-2.0-13.b6.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 1f38d65c8918f1829a95acd5f6e2f7cbd052180d042b155de9939ed08b08e419 byaccj-1.15-17.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 4fc678fa212e311334bc27b8dd491381d802a6de619685c0e9710057d4e074c5 cal10n-0.8.1-7.module+el8.10.0+23274+27840b45.src.rpm SHA-256: c27ea71df8c6fb7d5ae3edb5d0798909bb6edf52aee1467fcad722010fdfadd1 cdi-api-1.2-8.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 68809d53c71c3ccdb59343a49fcdf32edc2a882daee6c376954ba08ae2753b4a cglib-3.2.4-7.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 89bb27d26ef3037cab664d2388b449be636e97459bc7c7de02bc3435c2a90ddd easymock-3.5-4.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 0319dc1252becccd9ec15c53e43f3266c5c1ac6c87c509d3384253fa9113fa7e exec-maven-plugin-1.6.0-3.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 30753b3d057ac9edc102647ec199d2cdb06ef988871b95aa5acc0ef1c468e489 felix-osgi-compendium-1.4.0-26.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 15a38ed99206aceb49f76901798fb462ce7d1716e7a4b77a9f4c1da0706cc28a felix-osgi-core-1.4.0-23.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 37d83490f756f7b157bb0fae6352623f606962463f4eb47c8324b75d30457f20 felix-osgi-foundation-1.2.0-23.module+el8.10.0+23274+27840b45.src.rpm SHA-256: b5f8e2797ff833a66af6306f8b032803f9d8af94282c589979d412673e3cd01b felix-parent-4-5.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 18bcdcf36c7be9e448862580bc930e94de272a0a0c1b9ecf2b295c4b49a19790 felix-utils-1.10.4-2.module+el8.10.0+23274+27840b45.src.rpm SHA-256: e42a705578e7356cefa70775fe0f5fb392daa783319a112103e4c53647392097 forge-parent-38-11.module+el8.10.0+23274+27840b45.src.rpm SHA-256: c1a2247c66f5253ca3f74bcdfe8ed719cac3056caabfbb697d36991c6a1c7db0 fusesource-pom-1.11-3.module+el8.10.0+23274+27840b45.src.rpm SHA-256: db9591d29db9f67515e3402fa48e59a00819c74f3ec5e8952409995493ab1cda geronimo-annotation-1.0-23.module+el8.10.0+23274+27840b45.src.rpm SHA-256: e9d396daf0ca12016bd4358a9bd0b9ec0877029f69963f329f9f0bdd2a14bda1 geronimo-jms-1.1.1-25.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 0c322a1819a19c64990e8b27d01eb4887f7bcaf0e692484303bc86144c9df8f1 geronimo-jpa-1.1.1-21.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 6efe5b73efc657cb950a7996fb89a0028caae31c93a8ba316251c9fa7d67b814 geronimo-parent-poms-1.6-25.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 16688fb4f20afff8513c811e465d1bed38d3785072c9d866cbe77c8cdf570feb glassfish-annotation-api-1.2-13.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 2f5716af0aeaecf15c03359f130d9c7623b89c435a912a3a46c45df5f79f2da4 glassfish-el-3.0.1-0.7.b08.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 4faaf9c0d6a0f0812f4184aa9962f0c696e46f767350bb210bb49ac0a328831c glassfish-jsp-api-2.3.2-0.9.b01.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 06f2fea3a9e0bec92a2752b8af3891c9ce2ec96706bb4d0202f3e50a30fdfeaf glassfish-legal-1.1-11.module+el8.10.0+23274+27840b45.src.rpm SHA-256: c6a11d1c584c161034d65c249e3789082f2430484411b2148af19f42eb6ea80f glassfish-master-pom-8-11.module+el8.10.0+23274+27840b45.src.rpm SHA-256: f1bd4fb673d745863b9c71146c20f76c4d61fa4984f4589ecc586b66bf3520a2 glassfish-servlet-api-3.1.0-14.module+el8.10.0+23274+27840b45.src.rpm SHA-256: d34ce52bb827314096911fa50f7d0d60e2503297479beb80321b616d4a5bb18f google-guice-4.1-11.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 136edd9e1fea80f87f281676b6dac7c6430cba61aeecc7d18efb919a2d68406e guava20-20.0-8.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 8b0c618ff3160023588d4ce054c3adda23699fdb7a5f93b525a3b8f90bf632d4 hamcrest-1.3-23.module+el8.10.0+23274+27840b45.src.rpm SHA-256: a996f6424fe4d5dfdce2811be2432c9bca8992375c2a9e86e085b67a1ea00bb3 hawtjni-1.16-2.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 296e0bdfcdb52e620d03e50087794a90714b1b9611d27575009fbd89be29a9c1 httpcomponents-client-4.5.5-4.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 60c376a39ba9c8c67222edd4aaf9cf2d151ccc38c41ba19ee4c09a660543ad28 httpcomponents-core-4.4.10-4.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 18d16e8719cd23b09c4f1c67ff0ace9f7ae49b5ce0714711baa28413397dc461 httpcomponents-project-9-2.module+el8.10.0+23274+27840b45.src.rpm SHA-256: 3f4e8dd7be831ac9bdcd1327d8595888d0f2aee39bd3ec7ac851a395a48724d6 isorelax-0-0.23.release20050331.module+el8.10.0+23274+27840b45.src.rpm SHA-256: eb860c9534f239e4b268dc10b055df246762b18f52439c8fbf3dd7118a62e89c jakarta-commons-httpclient-3.1-28.module+el8.10.0+23274+27840b45.src.rpm SHA-256: d6b30f0edaacd5d4fd78c064b456cde9a7e1c3c0ce664083e0bd306455df