RHBA-2025:8213HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.9.12 bug fix release

Published
June 17, 2025
Last Modified
October 30, 2026

🔗 CVE IDs covered (2)

CVE-2025-21605 →CVE-2025-27144 →

📋 Description

CVE-2025-21605 — redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service

🎯 Affected products11

  • Quay v3
  • quay/clair-rhel8@sha256:c6ddb026071df0c5e2ed254f1dd59754282425f62bbb0108ecef79b278693c5c_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:ab6e96abc329c5f72fe1b0d8f58f12318cd6a839f3cdc9d2ee67e62d73230932_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:fbe4a163a7ee8275375fb4c03fdb416bf7f71bb3e80db8e60f21e54d9e505ff0_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:abafc0e59f6668214728f1d11d39f207a50e32285d34ec42be360b9958ef9df2_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:937c11c2809a12b2609d3869d843a6735bbc1b1f7ba02e999682ad695eff8a88_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:e94a181d8eee7fba81d293c70a470920ee02b6b2f8f5f368b7445cb030a52456_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:9fcfd2de9adadf3d3a983b0051d2a0043bde78cbe18cea36c10198d61a9708e8_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:bc579e916a49be8a4faeae6aaa2a6b7f127c4cc1ee8e5d51c73a645969bbbd0f_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:3baee927a5c71de6824979ec457a388fbfecdcc8c0cbe2f1ceb0e083bcb8a248_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:b86c95b701c8725673d785ef5aa514aa9b9b0c67ac5c3ff5d1b15541e0196a19_amd64 as a component of Quay v3

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in the following different ways: - Using network access control tools like firewalls, iptables, security groups, etc. - Enabling TLS and requiring users to authenticate using client side certificates. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.

🔗 References (2)