RHBA-2025:3653HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.11.10 bug fix release

Published
April 14, 2025
Last Modified
October 31, 2026

🔗 CVE IDs covered (4)

CVE-2025-22869 →CVE-2025-27516 →CVE-2024-6827 →CVE-2025-22868 →

📋 Description

CVE-2024-6827 — gunicorn: HTTP Request Smuggling in benoitc/gunicorn CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:22ddd4f1927d5f589caf07f8fa568499c574ddecb6eafc24a407b00787d37431_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:ac9f53b674d1887928a6758edb8235181f10d8fde111ffa531ae9374794fa48a_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:b5180464a990defad5f7ae2a5f2d82094d360742d1c2646c85f025b4c682935e_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:3ed39839c90b70eaced9257957f6bbf839c9ed154600e8ac08fc9c4f53556720_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:51dea3fb51f1b05298f06678907054a8587f3c06d2ac7b395f431f8ec1dce28d_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:58f341053c69f68dad585211b92356d193930b7814a47280f82ceab20e995ec2_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:58c1557d423551adb1ee43ce0d932c6113e3355cea964cc84009c61886dda832_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:a0d5bb4b2eff25c1949fb37d993e12654f9cf6ffd9fbcd71c210fc6bb5330b40_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:f5f97906816269fb4098d777c8dbfcb95cccc4cc58ce840cb133c12fe670c1d0_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:00e4f1fa04d57fa568a21f5e2940f42df6cb023971c6f2d94cde8d31b43339ae_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:b5df4fefdb021961cd4c0786b15ba76ff2cc124d411ad990945e3bc6825b566d_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:e4ca752aa637d6f0cf9b9cc8f0cacdef1636157c936c66708e0163bdb5654892_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:893015395b4d019e4f7b80797c76e3fb7be93fde2efddb5788ce7797345272dd_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:92d2032535ea3224454605049096b0d90f927818a0626437e3b0e5b81f65279c_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:93710fc81ed3fc2dea577b580b469c311bc874b1cc9a770af9c5f318aeb3f80a_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:2958154bf0dec8afad5277c1fca990e324d3e95727493e7d76a3049a63e760bb_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:78fc77b254d1c522853cb62c502bc9099593690a4fabd2120596f496627d5ac7_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:ed8900f8cd002ae1fc36abd98984ef43616399886fc0b60988d2fed1a667d450_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:05d86cd0b528ddd3079973f0e63e23024ffab0a49ff5e15f6849f6fa3576f817_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:2241cd14f1fc28244ff4b2f6fb0cb2a63cb01c6b2d909ca74164ab133f25912e_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:50b8ae1f66055a59b8a0db0d77e35a01e3edfab81a033cfe1c648ed3dc3c3db6_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:326c7bc3909c390a9a2265447c34f8868fb677d3d99d4c98473b665c1620ecf6_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:5755f7f1c44f0ba928f07746ae58a19915d7e57e6929bd5e0daaed8d511f88e6_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:9241d9983d0ecdd81df219c94d84af350da3ae15e05a31ff941554f34a562d64_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:50c6f827765ef339d45cfb46ceb01b4935ff41e6d1ff885ef1f59b6145d7e959_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:b88115249084734bc0b1b4dd30a02ba18d30d2f47671b2658eba85b47d8079fa_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:d04105b879d916c470d5a85e853763ea23b75b90d9f01bdf039090536f1f304a_ppc64le as a component of Quay v3
  • quay/quay-rhel8@sha256:113a87febd958ee9777287c5253bb28d35bad177080ac6c3f486f909b89304a6_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:17b95f994014c59921e252840404a2b99941e3e0063dc73d6f045f43d2be8efa_ppc64le as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat Product Security currently does not have a recommended mitigation at this time. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (2)