RHBA-2025:8212HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.10.11 bug fix release

Published
June 16, 2025
Last Modified
October 30, 2026

🔗 CVE IDs covered (2)

CVE-2025-21605 →CVE-2025-27144 →

📋 Description

CVE-2025-21605 — redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:1f4c608afee3d20de7c4c5936a9380423f208d232d1a2c390edf7f73136bff8a_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:4d6150fe880cd8b1c1b04a15397420d2d79adaf730bece9afe2f2fc6996d732b_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:b39ceaa48e63ac827d78c127b0a49e802d1e80bba35b5608b9cdecd4d98f14bf_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:80b82c23dd5265a77ee1f89b4b53b9acf9e03d1c3386e6811e76a09fac3a3853_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:f69ef7cf6f5b5e4c88908d036a4dbaf58e9a17101387a85cc6bd54909bed0c40_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:f7d99d7b2140b752f91051f93d0e54a747262bf8f7586a60db5561782c915922_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:1179564c2065f38444e51f4e0dec3585d6b32233f2d9c132302a053e8a8fa3a2_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:19c0fd2be13377baa48f598a228a430bd736fc69faaa370230bf1d4c3eea7016_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:f1c5c6fdb298b1c8e422699f4513ee6a17ca875d72ed20cfba13f7e9d32f46d2_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:94659ba9010eebfe4ffb77ecfa805479781acd855fedf343d1a4045cb1bef416_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:ca615d7921a091e51f13176079587bec3f41dd3f206a4ef21e12760dfafe7be3_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:fc209cffe72f734feb094bf190b455a88d05d8f93eed63422339ea138fef9f92_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:ba47477d334d76e9b4dfd1089fd2e6280a674377da77eaf9a578a984509f3e18_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:e39a73beadbce658d5aeba08e686f1cd292f0cd416852a0049c774c1d23b00cc_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:ebfecf03051e114f2af070360893986cac65290c3121b3380d03d511f2cb77db_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:0b3f812d2e8fbe6da47076fd28484b50bc8ec1af4c807c69e7897736e00cd966_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:dd20411d951ad7473f1d98c00c263b007f5f18aec13fa7f72d1657fbe594976a_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:f9493a7c1d73f099cb4d84a3bafad5bad4c2a2881f959c98f7d5111e9beba9ad_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:37877826649b73c1ba415d08c0837ed804ffb74a699e24648d1658151c6795ed_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:470e6cbfb1b9722f038b24a3c34f80967db860c75dd0821acbee19248a69f11b_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:4714ef57caff38e0dffbb510140b680080f456c5ece4fa40bd7415a9c35b17ef_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:4d0ac1d9b97c910ef56f140d17e5bd80ab0319946dbec5570ed95d01f8aec383_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:7cd87c2f2c5dfb28680d61f8882e68b695ce5188dbca8a28dfdfcd3eb6e80549_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:d2a80e6052ed0fe00bd43a6a2c4cdae25c3d2a3f0616e152c753d2365a086df0_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:24a349821d24a325526502c29d5e984143fe7840911be8243a2e046354c51686_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:7bd1c33e074d53456b047ea5341b260652fe4dcde7b3774feb3a600c43287049_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:a82e33c6acb2d5288538d8bca7fbb76103be2323aa262cb5467e88fd5bdaf101_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:0966dc62494fa8af9b233cc3a4a8d579b39893c4d278f0c4494550779391bc10_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:925f25e189ce460fac9a4df3537d83407d08344e8642c8b8cb585bf185bee9ca_amd64 as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in the following different ways: - Using network access control tools like firewalls, iptables, security groups, etc. - Enabling TLS and requiring users to authenticate using client side certificates. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.

🔗 References (2)