RHSA-2025:1870HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (osp-director-operator) security update

Published
February 26, 2025
Last Modified
October 13, 2026

🔗 CVE IDs covered (2)

CVE-2025-21613 →CVE-2025-21614 →

📋 Description

CVE-2025-21613 — go-git: argument injection via the URL field CVE-2025-21614 — go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies

🎯 Affected products5

  • Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-agent@sha256:a72382bacac1d99ee3c7391cb76b5930e9424b6e8fa3deed8dda03b054495f84_amd64 as a component of Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-downloader@sha256:034891a629861fa1e3947466141787d5211b97e69f0d2b7a74516bfeb9f191d7_amd64 as a component of Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-operator-bundle@sha256:a5a31f5e21b190a208348d5d1e3c8f791ffdf7ec7c1d65f80bd796cf4522d014_amd64 as a component of Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-operator@sha256:93a5bf00b2caf1f65558275f8fa18a36286134010b72d16e4b8ac72ed1e460e5_amd64 as a component of Red Hat OpenStack Platform 17.1

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (7)