RHBA-2025:7674HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.14.1 bug fix release

Published
May 15, 2025
Last Modified
October 24, 2026

🔗 CVE IDs covered (3)

CVE-2025-22868 →CVE-2025-22869 →CVE-2025-27516 →

📋 Description

CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:0f3abf42a6d0477d38aebb01145b2958239f8086b32a1d995a13c4148b200e00_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:180f5a0e95e8b3007d62de998d0b5c07acf98077eb2ef60653164a57c01493e6_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:f3bba797e4ef9e5f53ce7f0df622fd1f7b18f33af78b5d8e4f14e98cec803ab7_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:481162609427b823920c93a8c3f62a8eec97b29103c9525546d943a77c2e3f88_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:7a0cd9ec44d5a411eb7e8230c3121425d64ef06a8d2ee2ab549f5830966cf525_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:d783dc9ca701f4d06550c11274ae432b70c827dd6dfc0cd53083112ab2c934cb_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:6194c2cb93e3a64a84f50aa071b0bdb437402dd505aedf1428be358a4abcffb4_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:76351f73fbd6ce2cf9c372f2b3b3b7b5104bf905782b2ad38ee27fb2b9891799_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:b4e4aa556edf6eaa97807a31966b8abab3027000a63dcdc051f77b7f6aa1b576_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:22ad43f75e0b44a9b4b6146b226790525c6ddb04391fe4e0be726d3e9c56e334_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:960a918825b0b3044632e1412e46521cbb45f0ee96fa27a4878145e6b6758710_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:fea1e37a197bab995cee470bf474c85126d32bc992ae61ac36b3f1c732da0526_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:3436d331e245c7717e850551ca0a75ef0946cb1de7a60b49e75c331ed2b4bfcf_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:7196db2e7812fbe818cad31d559a96e42f0444eb5b73cd2f492746da2826eb72_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:79a0edb096c22f3da3b7ce842b0096478e0f4b03a0f0f3d45e3376be44725edf_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:123de7077d1e312028e43276994c0241b6ab7fd6c90529749f1aebac5ecd84eb_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:55a0afe2d4ffd72f4d1fddadbea280941c020e741acbfa6a5152c3331b130714_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:e3c4f6573426071004afd6112f14eaf528c735517e4e24408069c7e221c5aa59_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:4e412ed2ffc7cbf3eb58fbab93e87e13653cabd010e14b902ce2e36adae0bf30_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:5ea9148cddc8cea3a54876b75871f010716888f0afe63e5699dc4363ec32d5e2_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:f4ecbbf9355ec0cc9b49aaefd30d21ca9fe0372a72f17bac5b3eb6207b5a9c84_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:29f32df896c9916f853f4d33e0fd411b5662e7bb2e2e9bad414afbcaa096a75a_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:b71cd8c82f6915578b9d4a0ecc86c4dcc3e8dbc9cbafe199320971019b1850eb_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:d9fc5df956f8c6eadee8bffe5c87f39046c3aba12d27b94a230ee3d95f1bb4ce_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:62e4e9704df33a38978ae53093a00d6d3dd1ec52d948847258efa071907fa89d_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:6389a934229c9677067d1540b98fa73bb25b44e704abc6634a2ba305439c9899_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:75dc27fc000f1008eb1a52aee371c5e327e44464014f44d31ce56bba41e9288a_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:07b14d30216cdda2282e266bfda2b05e42483eb7da3dec2bc3f72a7b55719d87_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:88f934345fe6f98db6469acadaee891f7a106151b3a4b9ead4530043a230b3dc_s390x as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)