RHBA-2025:1597HighCVSS 8.2

Red Hat Bug Fix Advisory: Red Hat Quay v3.9.10 bug fix release

Published
February 24, 2025
Last Modified
October 29, 2026

🔗 CVE IDs covered (4)

CVE-2020-11023 →CVE-2024-45337 →CVE-2024-56201 →CVE-2024-56326 →

📋 Description

CVE-2020-11023 — jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-56201 — jinja2: Jinja has a sandbox breakout through malicious filenames CVE-2024-56326 — jinja2: Jinja has a sandbox breakout through indirect reference to format method

🎯 Affected products11

  • Quay v3
  • quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64 as a component of Quay v3

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (2)