RHBA-2025:3652HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.12.9 bug fix release

Published
April 21, 2025
Last Modified
September 17, 2026

🔗 CVE IDs covered (4)

CVE-2024-6827 →CVE-2025-22868 →CVE-2025-22869 →CVE-2025-27516 →

📋 Description

CVE-2024-6827 — gunicorn: HTTP Request Smuggling in benoitc/gunicorn CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:34790b8a4a822ab175a7ecdae0780a3aa9b7ff1514551872f739bb09c29d6f38_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:85be832080d7b7d926d867ae0ff7221cdbf0eae547c7a001cef386751d9ee33c_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:91d87dd972ffcb5f6f5816bc8230c6d6ee5a0b05c93bb7835219a3071b51c71a_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:7ae378dc3dde53a4f9f1e306fdbed285ef7e76825d37442838c8c559ce0247c1_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:a727fe3de80c4d453b988a836ac3603ed74557c1216d7856f2e4811e498ccb88_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:d0bf57b80b5e7f651c6b2b5065b254d2c15a27b78797e54806f49e42e5c005d9_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:01b9068a46e4247b6d82dbfca2638e2a65ab8865153041095147026fc095eaf8_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:5f0dbf0ecc76e4f7801d32817c2d94af5d53092a976a07873b2178a1956d85ff_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:e1cba8f320e9b9bd0e03c16ab4dcf1df732d00e7801a756fc1f0b991a825307f_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:ae8ef1d4e3008e90bfc741495528d69fe00738bc26434296c44eceba58ff5689_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:c520b578db802c3a4be452c19b3d2cdd0e6e253b6af49b33e4e53667ad33d32e_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:e95226fbb50c690c3f781b29c6fdf2bc07b31fada34a07299549aff69059f787_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:06f9a6fd3ff94dea7ac118a2eb4207dd70875e84df4fdc0aee3ec4539d123eb3_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:31cc757862f8a72e3b28dad7969996c6d30cb331ffd0e2b9118f31ed7f81b37e_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:ddcc66bf8221a679c73b3dbf7de905113f03a90c8fb55e2b49dd058b621e0ae9_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:020aef030a5c28e95ad5a9de996483764d4f65b3d5f2d8af4f352171bd006504_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:20de35a6f5a39383d2a5d4a97e23a682e53f897117d091f7e7328949da1e004e_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:d2dad1434cbf1acbdb1d83744984f812b113e64aee3adcbc1cb01068ff462e40_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:2be6546905f6cd4a458bc77ad39bb1052def8c2482e6fe99a49db20059c21fd4_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:b80c80062bcd83036c40e66e2fb2eba872c24b7fdfdd74d11f84bc2c7398965f_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:ca361d8b0506fce2edb0ab4db12a933dd3a3485ce33dd53fd4d7f0a618b13fea_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:0bf0a45400d5e1c7b5b36cba3e722b6401d804f3ebb05bbbff999d26d92c6997_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:82ed438da5437711a631db7653d3e8cb6c25806cebafcca5706bf7911e2627b3_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:c9f3b604b9a0ddae02f7ed5777d8c904080e27bb65c108bc100e8753936e995c_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:055f267a5851710283b70e7333be2f6f01f3c910e6d5a4a3432190cf17ee1205_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:3167be7c478b4d412da9cd5473175479b3896b9248495bff061ad59b87d09651_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:cb127341754fcc8a587a06ecd7a31fe0b2b4dda13829f5e577bf72ad7be25b31_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:1594eb4c62118f1e18ef5ca1bf93aa209ca8350d3f8231221a1f31a03ea9498c_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:e558f4e7b441a34bd9004e9ecb05859fd99e7be37c7143ccbbe04066cfcd8be8_ppc64le as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat Product Security currently does not have a recommended mitigation at this time. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers.

🔗 References (2)