RHBA-2025:8262HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.14.2 bug fix release

Published
June 9, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (3)

CVE-2024-21538 →CVE-2025-4374 →CVE-2025-21605 →

📋 Description

CVE-2024-21538 — cross-spawn: regular expression denial of service CVE-2025-4374 — quay: Incorrect Privilege Assignment CVE-2025-21605 — redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le as a component of Quay v3
  • quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64 as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Permissions can be updated after creation but there's no preventative measure before hand. Workaround: A workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in the following different ways: - Using network access control tools like firewalls, iptables, security groups, etc. - Enabling TLS and requiring users to authenticate using client side certificates.

🔗 References (3)