RHBA-2025:8687HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.11.11 bug fix release

Published
June 9, 2025
Last Modified
August 17, 2026

🔗 CVE IDs covered (3)

CVE-2025-4374 →CVE-2025-21605 →CVE-2025-27144 →

📋 Description

CVE-2025-4374 — quay: Incorrect Privilege Assignment CVE-2025-21605 — redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:195d1076c636f40c7c9198bc03f57e5caa67ee5f5648c2a121bd1f4345de6203_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:bd0ca7a67def94121faf334f482465e666c0b3a1d40b3c977e2fe94ac6643201_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:d8b585baf2ff14b46fb68d190f74b2f2559bf9f5b46e4431d79ed0a4f638fd9d_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:21d1a26656c700442b629207f724d291f8eff7f303038ef70df4154a06575931_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:8740e77ef175acfbb456fc5dbdf4f1e22cb7ff962087397a9997c4d5932be4f9_s390x as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:ce39113b1ebd3f300517d14060c1fe1275961b949dd75d8e9f162d00c6c8255a_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:2fcf4c37460be6f3ea71a563d6dea75525c6dc61252046be022ac9f2529ffc71_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:4a12940b0afe3a9331f258abeffcd6242c0444caeddf6c47d0d70e863db62187_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:9911e8f20d67deda29c332879edeee35bebbec9e3ab8d1db9a62c4553476e26b_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:3468cffc4a1ea9c17fc8e5a6d470d8d0ee63f638b6c458a6b883d1aab24a6f4b_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:702af420a47897b70036aaaa8bf44ef35dc13b0a92c616bdc21217ee778815c7_s390x as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:b0a17ffff189b7b32237cb0aab50a5355a7a59418076a7d883e6b432886ce03d_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:28f79dceab182cc9f4fa147e4cb364e399ee9e65c45f44cd532b28b72b11c698_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:4bfaa2f95612fdbd64c7f8c1b8a9a3d10a2102b2c47e29d9747f96f33e7d69ae_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:fa2702d91fc2e207d54f8ae17ad0be4b175a73ab89b18e0eafc0a8b398ea3e75_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:172f67f2655272d3eb30e1e680283ed42f7dba9576c1fd0b470be9cc06bb31b4_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:588321718eadd8f84f2d919c0f28ba083a75bb3f2e252d01a4da4f133bb5a0f0_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:991687f2aa06c3e35818af26cd85c3dc8c41ee4188e158ca77c842674b724495_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:4beaed2ea669c9cd47e6533b201a7e9b64b073d9cbf66b370ef3f1cc5016f7c6_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:e825cd96187bcd9dc6d2c5be510d875a9829bc06eb2691613ac436cbb118d3af_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:f44a6c70737ba6f53550dd2eeff263ae26c3c0f4f545573712c87a79e570fb46_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:4e71a205c9cbb94c923b835b23db4c0e976429e76e40bba306799e87c7a4d588_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:812444ea940a077d450259c0e4b4ae54dae59d36db5bb13285cd4374e0cf7d4c_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:ea0b4d42b96c2265cf904323fc8969123f700658490b1b6074fa0f5b27f96350_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:163e370882e2546cfb36feb602c669cf0a39c521431e01ddfc06a6b57c0a12e9_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:24deedb355071b9634b0dbc9d54443a3c66830742c9387e6c693d76428cf0550_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:ea0f584599bde80148ae2409494a7d79b05f352b7f1785d1eb5d1f66e98f32f7_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:310193852bc1e7eafa12a5c2676b03f5ef9e80d1a0520749c59e6552a233443e_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:3ca6eb6e9efda961aceaac5752208cfc3e91ca434bdc6848884ab6de45aff6f5_ppc64le as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Permissions can be updated after creation but there's no preventative measure before hand. Workaround: A workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in the following different ways: - Using network access control tools like firewalls, iptables, security groups, etc. - Enabling TLS and requiring users to authenticate using client side certificates. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.

🔗 References (2)