RHBA-2025:4023HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.10.10 bug fix release

Published
April 24, 2025
Last Modified
October 31, 2026

🔗 CVE IDs covered (4)

CVE-2025-22869 →CVE-2025-27516 →CVE-2024-6827 →CVE-2025-22868 →

📋 Description

CVE-2024-6827 — gunicorn: HTTP Request Smuggling in benoitc/gunicorn CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:2b2d36679669e18ef6168798432aba1840c792f954f73aeb4afd51e3175d13a7_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:5f5baa653a27718e5deb946f9987551f18ac7c1b338f63a77dc6a551f2fefd3a_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:cd684066f726cebc58ab1eabf9835770f70e0178d7a2dc0677e8a50ead298c4d_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:53d4368e537c56905e66c6d381ff967c028afc765caff4d0fb293ea12efc5936_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:662761f1dc7f7fcc7f10d37ce6dcf7da7be3865c1c217b716f18394b6fa2142d_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:8822090b8c5c0d58a248d02092d61b86af6cc6f899287bc86133b7e768a6df5a_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:7ff37f866fbbf5dcfa7a146b0e113f12171041c9a9880a7d9a9ff10ec6e03567_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:ebc2147496806864ba214f87c3b1342df980d020f3e04f4b1e177448d3ac1a0b_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:f2e7399a04b441485a4ae690bac418324cb7b96af183e6856e80357878b7d893_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:a7ef4a1e70ecce42fa3dffb0f01b584a9935d58a820fbaf2cf4c0611b3c1dfb7_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:aeae6eb284811fe8bddd1183bfc9fb7578183fc3236681aba93649ebcf73e0b4_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:bdeaeba48329e6df9c62309bb8e38df8a6c60b969da490d7edeb59878ec8cda0_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:27e77c2d5d71fd2badeebbccaea3bf9a423f29cb85be037f86d3a47ca8e767df_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:b8e6ad06598edbbc36cf4c919f40220ae33571ab86d22b2aea451a7d9b3966a4_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:ef223a6e094651f496c0899f941f047d12133155fc59730f5627c2c96cf6ce22_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:0e7d09404a3bd58b4d6f6f21cb985d2c65f1eff5ece628a056205686cbadfc4d_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:7434e2519403d2bfd60a8afc85656754d8026b060861a453e746e345de2581e7_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:b201cc321bbe53ae2440cf7b2fec3cf1814d9692c7202a083b68686d9c1daaa0_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:2b4bff319c03a1a8c37483971388408e16e9120cf7e3118989bbdf34ba9f9234_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:641359f56e52458a2b87c2c0a2691c0c084b6c188c2c5382ce7200a18a7c5f11_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:89394c8a3257bbf4578e5eb7d4446bf2e1a3860519df879ceead536f8db82507_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:b80447a41e343b1d7477160539e6fa64f31860d4573485b7d0639f4c25a4356c_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:bba4277aa8b8e4bc87193138427670114e8e9b5f0b8dd6033b4e489c44d769e6_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:c5a57e925ab46a0f66a1b691400b305007a01803afc8173e66011aa835e8547a_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:6dac58289c937d73a3fdb1f2b6fe50ba94d5139618ff616aad9c28315bd968c6_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:8a7dce5a8321a6deb44b13e2ef522b41bb93100c3ca657d0418fe14841051264_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:e0c8633957cd76fb4f21b20402089d779888941d940ea1c6aed16a881e9bb668_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:40c99099b7486efd908bb94056e14dd50be3001036da1f73e4cabe96cb1102d3_ppc64le as a component of Quay v3
  • quay/quay-rhel8@sha256:9cd6745a1fdeea73a4bfa75149141cb2f0ca862b2969fc30472faa91e9eec44e_s390x as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat Product Security currently does not have a recommended mitigation at this time. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (2)