A vulnerability in BusyBox httpd within Red Hat Hardened Images allows for an authentication bypass due to the mishandling of yescrypt password hashes.

The vulnerability is an authentication bypass (CWE-305) triggered when the httpd component processes yescrypt ($y$) password hashes as plaintext, effectively inverting the intended authentication logic for unauthenticated remote attackers.

Successful exploitation permits unauthorized access to systems protected by Basic Authentication, potentially leading to the compromise of sensitive data or unauthorized configuration changes. Although the CVSS score of 6.5 reflects a Medium severity, the ability to bypass authentication mechanisms fundamentally undermines the security posture of any service relying on these images for identity verification.

Immediate Action: Consult the Red Hat security advisory portal to identify the specific updated versions of Red Hat Hardened Images that contain the patched BusyBox component and deploy them immediately.

Proactive Monitoring: Review web server access logs for anomalous authentication patterns or unexpected successful logins that do not correlate with known user activity.

Compensating Controls: Implement network-level access controls or a Web Application Firewall (WAF) to restrict access to services utilizing Basic Authentication until the underlying software can be updated.

Public Exploit Available: No (exploit_available: unknown)

Security teams should prioritize verifying their current deployment versions against the latest Red Hat security bulletins. Given that this vulnerability affects the core authentication mechanism of the httpd service, upgrading to the remediated versions is the only definitive way to restore access control integrity and mitigate the risk of unauthorized entry.