RHSA-2025:21981HighCVSS 8.1

Red Hat Security Advisory: RHTAS 1.3.1 - Red Hat Trusted Artifact Signer Release

Published
November 24, 2025
Last Modified
August 2, 2026

🔗 CVE IDs covered (2)

CVE-2025-11621 →CVE-2025-12044 →

📋 Description

CVE-2025-11621 — github.com/hashicorp/vault: Vault AWS auth method bypass due to AWS client cache CVE-2025-12044 — github.com/hashicorp/vault: Vault Vulnerable to Denial of Service Due to Rate Limit Regression

🎯 Affected products4

  • Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:57f1db8dd5e9cb42078a20c065c1f3052175a88d77b656f4c8e903ab40088303_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:3782ef36eac0a40b3b8d018476d0af7505d2a81f0ccb993644e8c5f20f1cd566_amd64 as a component of Red Hat Trusted Artifact Signer 1.3
  • registry.redhat.io/rhtas/rekor-server-rhel9@sha256:799b0b86f83f0fdf450ecbd2726419570b15f6ec5ba5b814750d45b8269e4dac_amd64 as a component of Red Hat Trusted Artifact Signer 1.3

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)