RHBA-2025:3652HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.12.9 bug fix release

Published
April 21, 2025
Last Modified
October 31, 2026

🔗 CVE IDs covered (4)

CVE-2025-27516 →CVE-2024-6827 →CVE-2025-22868 →CVE-2025-22869 →

📋 Description

CVE-2024-6827 — gunicorn: HTTP Request Smuggling in benoitc/gunicorn CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:34790b8a4a822ab175a7ecdae0780a3aa9b7ff1514551872f739bb09c29d6f38_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:85be832080d7b7d926d867ae0ff7221cdbf0eae547c7a001cef386751d9ee33c_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:91d87dd972ffcb5f6f5816bc8230c6d6ee5a0b05c93bb7835219a3071b51c71a_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:7ae378dc3dde53a4f9f1e306fdbed285ef7e76825d37442838c8c559ce0247c1_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:a727fe3de80c4d453b988a836ac3603ed74557c1216d7856f2e4811e498ccb88_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:d0bf57b80b5e7f651c6b2b5065b254d2c15a27b78797e54806f49e42e5c005d9_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:01b9068a46e4247b6d82dbfca2638e2a65ab8865153041095147026fc095eaf8_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:5f0dbf0ecc76e4f7801d32817c2d94af5d53092a976a07873b2178a1956d85ff_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:e1cba8f320e9b9bd0e03c16ab4dcf1df732d00e7801a756fc1f0b991a825307f_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:ae8ef1d4e3008e90bfc741495528d69fe00738bc26434296c44eceba58ff5689_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:c520b578db802c3a4be452c19b3d2cdd0e6e253b6af49b33e4e53667ad33d32e_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:e95226fbb50c690c3f781b29c6fdf2bc07b31fada34a07299549aff69059f787_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:06f9a6fd3ff94dea7ac118a2eb4207dd70875e84df4fdc0aee3ec4539d123eb3_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:31cc757862f8a72e3b28dad7969996c6d30cb331ffd0e2b9118f31ed7f81b37e_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:ddcc66bf8221a679c73b3dbf7de905113f03a90c8fb55e2b49dd058b621e0ae9_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:020aef030a5c28e95ad5a9de996483764d4f65b3d5f2d8af4f352171bd006504_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:20de35a6f5a39383d2a5d4a97e23a682e53f897117d091f7e7328949da1e004e_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:d2dad1434cbf1acbdb1d83744984f812b113e64aee3adcbc1cb01068ff462e40_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:2be6546905f6cd4a458bc77ad39bb1052def8c2482e6fe99a49db20059c21fd4_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:b80c80062bcd83036c40e66e2fb2eba872c24b7fdfdd74d11f84bc2c7398965f_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:ca361d8b0506fce2edb0ab4db12a933dd3a3485ce33dd53fd4d7f0a618b13fea_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:0bf0a45400d5e1c7b5b36cba3e722b6401d804f3ebb05bbbff999d26d92c6997_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:82ed438da5437711a631db7653d3e8cb6c25806cebafcca5706bf7911e2627b3_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:c9f3b604b9a0ddae02f7ed5777d8c904080e27bb65c108bc100e8753936e995c_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:055f267a5851710283b70e7333be2f6f01f3c910e6d5a4a3432190cf17ee1205_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:3167be7c478b4d412da9cd5473175479b3896b9248495bff061ad59b87d09651_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:cb127341754fcc8a587a06ecd7a31fe0b2b4dda13829f5e577bf72ad7be25b31_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:1594eb4c62118f1e18ef5ca1bf93aa209ca8350d3f8231221a1f31a03ea9498c_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:e558f4e7b441a34bd9004e9ecb05859fd99e7be37c7143ccbbe04066cfcd8be8_ppc64le as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat Product Security currently does not have a recommended mitigation at this time. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (2)