RHBA-2025:3651HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.13.5 bug fix release

Published
May 9, 2025
Last Modified
November 3, 2026

🔗 CVE IDs covered (4)

CVE-2024-6827 →CVE-2025-22868 →CVE-2025-22869 →CVE-2025-27516 →

📋 Description

CVE-2024-6827 — gunicorn: HTTP Request Smuggling in benoitc/gunicorn CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat Product Security currently does not have a recommended mitigation at this time. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (4)