RHBA-2025:1597HighCVSS 8.2

Red Hat Bug Fix Advisory: Red Hat Quay v3.9.10 bug fix release

Published
February 24, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (4)

CVE-2024-45337 →CVE-2024-56201 →CVE-2024-56326 →CVE-2020-11023 →

📋 Description

CVE-2020-11023 — jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-56201 — jinja2: Jinja has a sandbox breakout through malicious filenames CVE-2024-56326 — jinja2: Jinja has a sandbox breakout through indirect reference to format method

🎯 Affected products11

  • Quay v3
  • quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64 as a component of Quay v3

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates.

🔗 References (2)