RHSA-2025:11396HighCVSS 8.2

Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update

Published
July 18, 2025
Last Modified
August 26, 2026

🔗 CVE IDs covered (8)

CVE-2025-22868 →CVE-2025-22869 →CVE-2025-22871 →CVE-2025-27144 →CVE-2025-30204 →CVE-2024-45337 →CVE-2024-45338 →CVE-2025-21613 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-21613 — go-git: argument injection via the URL field CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-22871 — net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products45

  • 9Base-OADP-1.4
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:2bae3100587b970b7246ae28196982edc6b9dae145f4d8c812fc9d78bff20961_amd64 as a component of 9Base-OADP-1.4
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:475a27e370e023af9fc2698ce9b14a97cd0302d27f2bc52dc680bb63a82eb707_s390x as a component of 9Base-OADP-1.4
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e4699d011786df4d3b8481b0b79a41c6cf2450c28a96d983b506393734a24c3a_ppc64le as a component of 9Base-OADP-1.4
  • oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f78f207306aebfe90a9126218b77b64a088b68122f8805b5b69e47972e5d298a_arm64 as a component of 9Base-OADP-1.4
  • oadp/oadp-mustgather-rhel9@sha256:41f32fb3b6f3c1ed7be1f2580dd0fcc861c8240c8470b4e0346e0ba5bbb512b5_s390x as a component of 9Base-OADP-1.4
  • oadp/oadp-mustgather-rhel9@sha256:a0dad19da75a825d5756e033590df8cdb5a6af0f55f906b9b1000d4c3adccd5a_amd64 as a component of 9Base-OADP-1.4
  • oadp/oadp-mustgather-rhel9@sha256:abf07f4cad8f18537ccc2f162b25e11a5cae547c5f0db789f573ebc42a327041_arm64 as a component of 9Base-OADP-1.4
  • oadp/oadp-mustgather-rhel9@sha256:d9bcac4f030c419292e13e517baf606514dece94182328e9f54058508a5138f1_ppc64le as a component of 9Base-OADP-1.4
  • oadp/oadp-operator-bundle@sha256:7317ed83242340597b5cdde8ee314606ddd563d0067ee85c12eb21037e2feb99_amd64 as a component of 9Base-OADP-1.4
  • oadp/oadp-operator-bundle@sha256:7bbd1cb460a20aa568f543122ead86a7590827ed04166b82902cd68f60c67b4a_arm64 as a component of 9Base-OADP-1.4
  • oadp/oadp-operator-bundle@sha256:c06a0dc726d75fbed4c5f0ed5beb1abafdc2f85997d9d0b1dab41775b7ffe07d_s390x as a component of 9Base-OADP-1.4
  • oadp/oadp-operator-bundle@sha256:f05c810e2b1c445a5d997826f423b6759c11b188dd8781af5908c085d082ceac_ppc64le as a component of 9Base-OADP-1.4
  • oadp/oadp-rhel9-operator@sha256:a695cf5140b0b109ede8c718c7b5b720fbe3f92c033f999506d78e2341c01203_ppc64le as a component of 9Base-OADP-1.4
  • oadp/oadp-rhel9-operator@sha256:a8b86cbc818be479fd560b85e129e917c2314c82070d39a0c1453d8f11631ec5_s390x as a component of 9Base-OADP-1.4
  • oadp/oadp-rhel9-operator@sha256:c64c81ccaa4d3ed1c2b333936b0a9aa111e4dde2de88af5780ebd83f3b29bad6_amd64 as a component of 9Base-OADP-1.4
  • oadp/oadp-rhel9-operator@sha256:e4a7bd1b9aeae7350256a65fcb094cff2622e569ca8768df63d43682dff364d4_arm64 as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2cdd8800ab19ff52a6682d3a6477c745b09224998dd4d7c5882111496ae8ec09_amd64 as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:36a22693fd6d1d2721f2f6d579bc638d51ae3648766cc57118f6956cd10aba36_arm64 as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:969922831941453a7d0c16bbe908b3b3596493134e68e771bd49ed9460f38bf1_ppc64le as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-aws-rhel9@sha256:e97dc347f843eab864efb81f939b425554e6db58cde788a942afd7b00ac470df_s390x as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:6ab225df2a249068ce7f22d909916ee94e58abcbae8662d4df3f0e93e4b97eed_arm64 as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a654a342057e7f679a96a5f18069bf6568e9a9f59f9f1934bf02f346a73cfe25_ppc64le as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d70161cdeb833ec007dfad5a7f1b1ff411a10fe054b9ede12f3d7879e201ee17_amd64 as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d9cc11a9154a89f84d66874f773225b6ac2b9a3342bd4d15cbb2ee8639c5f05f_s390x as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:121c80f73d2739694de126801e5c9622584ddc61fad9d1953e56fc83439ce074_amd64 as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:1ead7c1b32cb4ff2ec3002142a2fa25dbde1cc99c9ab07742e06981055963716_ppc64le as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f7b3d93c79057eaefd036c8aa06f392487a73c1dde9a5bdecac73610b42461d_arm64 as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:cc1323f77941a5c0d4202ab96ca1643b6d06df4febf996de2ee82f43010e319c_s390x as a component of 9Base-OADP-1.4
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:18bfc85cc1a69536c266b0d168644406ccab9943aeb076a4e1a241655783a199_s390x as a component of 9Base-OADP-1.4
  • +15 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (12)