chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
kernel-headers	4.18.0-553.100.1.el8_10 -> 4.18.0-553.104.1.el8_10
libblkid	2.32.1-47.el8_10 -> 2.32.1-48.el8_10
libfdisk	2.32.1-47.el8_10 -> 2.32.1-48.el8_10
libmount	2.32.1-47.el8_10 -> 2.32.1-48.el8_10
libsmartcols	2.32.1-47.el8_10 -> 2.32.1-48.el8_10
libuuid	2.32.1-47.el8_10 -> 2.32.1-48.el8_10
libuuid-devel	2.32.1-47.el8_10 -> 2.32.1-48.el8_10
platform-python	3.6.8-72.el8_10 -> 3.6.8-73.el8_10
python3-libs	3.6.8-72.el8_10 -> 3.6.8-73.el8_10
util-linux	2.32.1-47.el8_10 -> 2.32.1-48.el8_10

---

util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames

CVE-2025-14104

More information

Details

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam() function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-14104
• https://bugzilla.redhat.com/show_bug.cgi?id=2419369
• https://www.cve.org/CVERecord?id=CVE-2025-14104
• https://nvd.nist.gov/vuln/detail/CVE-2025-14104

---

cpython: wsgiref.headers.Headers allows header newline injection in Python

CVE-2026-0865

More information

Details

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-0865
• https://bugzilla.redhat.com/show_bug.cgi?id=2431367
• https://www.cve.org/CVERecord?id=CVE-2026-0865
• https://nvd.nist.gov/vuln/detail/CVE-2026-0865
• https://github.com/python/cpython/issues/143916
• https://github.com/python/cpython/pull/143917
• https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/

---

cpython: POP3 command injection in user-controlled commands

CVE-2025-15367

More information

Details

A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-15367
• https://bugzilla.redhat.com/show_bug.cgi?id=2431373
• https://www.cve.org/CVERecord?id=CVE-2025-15367
• https://nvd.nist.gov/vuln/detail/CVE-2025-15367
• https://github.com/python/cpython/issues/143923
• https://github.com/python/cpython/pull/143924
• https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/

---

cpython: email header injection due to unquoted newlines

CVE-2026-1299

More information

Details

A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-1299
• https://bugzilla.redhat.com/show_bug.cgi?id=2432437
• https://www.cve.org/CVERecord?id=CVE-2026-1299
• https://nvd.nist.gov/vuln/detail/CVE-2026-1299
• https://cve.org/CVERecord?id=CVE-2024-6923
• https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413
• https://github.com/python/cpython/issues/144125
• https://github.com/python/cpython/pull/144126
• https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/

---

cpython: IMAP command injection in user-controlled commands

CVE-2025-15366

More information

Details

A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-15366
• https://bugzilla.redhat.com/show_bug.cgi?id=2431368
• https://www.cve.org/CVERecord?id=CVE-2025-15366
• https://nvd.nist.gov/vuln/detail/CVE-2025-15366
• https://github.com/python/cpython/issues/143921
• https://github.com/python/cpython/pull/143922
• https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.

[rhacs-bot]

Auto-approved by automation.

[github-actions]

/retest collector-on-push

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.61%. Comparing base (d228b7f) to head (85828a7).
⚠️ Report is 1 commits behind head on release-3.22.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.22    #2847   +/-   ##
=============================================
  Coverage         27.61%   27.61%           
=============================================
  Files                96       96           
  Lines              5424     5424           
  Branches           2523     2523           
=============================================
  Hits               1498     1498           
  Misses             3214     3214           
  Partials            712      712           

Flag	Coverage Δ
collector-unit-tests	27.61% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

/retest collector-on-push

[red-hat-konflux]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.