RHSA-2025:1870HighCVSS 8.1
Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (osp-director-operator) security update
🔗 CVE IDs covered (2)
📋 Description
CVE-2025-21613 — go-git: argument injection via the URL field CVE-2025-21614 — go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies
🎯 Affected products5
- Red Hat OpenStack Platform 17.1
- rhosp-rhel9/osp-director-agent@sha256:a72382bacac1d99ee3c7391cb76b5930e9424b6e8fa3deed8dda03b054495f84_amd64 as a component of Red Hat OpenStack Platform 17.1
- rhosp-rhel9/osp-director-downloader@sha256:034891a629861fa1e3947466141787d5211b97e69f0d2b7a74516bfeb9f191d7_amd64 as a component of Red Hat OpenStack Platform 17.1
- rhosp-rhel9/osp-director-operator-bundle@sha256:a5a31f5e21b190a208348d5d1e3c8f791ffdf7ec7c1d65f80bd796cf4522d014_amd64 as a component of Red Hat OpenStack Platform 17.1
- rhosp-rhel9/osp-director-operator@sha256:93a5bf00b2caf1f65558275f8fa18a36286134010b72d16e4b8ac72ed1e460e5_amd64 as a component of Red Hat OpenStack Platform 17.1
✅ Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2025:1870
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2335888
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2335901
- externalhttps://issues.redhat.com/browse/OSPRH-12350
- externalhttps://issues.redhat.com/browse/OSPRH-14161
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1870.json