RHSA-2025:22529HighCVSS 8.8

Red Hat Security Advisory: Red Hat Ceph Storage

Published
December 1, 2025
Last Modified
September 1, 2026

🔗 CVE IDs covered (12)

CVE-2024-56433 →CVE-2025-6395 →CVE-2025-6965 →CVE-2025-9230 →CVE-2025-11561 →CVE-2025-32415 →CVE-2025-32989 →CVE-2022-29458 →CVE-2025-8058 →CVE-2025-32414 →CVE-2025-32988 →CVE-2025-32990 →

📋 Description

CVE-2022-29458 — ncurses: segfaulting OOB read CVE-2024-56433 — shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2025-6395 — gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-8058 — glibc: Double free in glibc CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-11561 — sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems CVE-2025-32414 — libxml2: Out-of-Bounds Read in libxml2 CVE-2025-32415 — libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables CVE-2025-32988 — gnutls: Vulnerability in GnuTLS otherName SAN export CVE-2025-32989 — gnutls: Vulnerability in GnuTLS SCT extension parsing CVE-2025-32990 — gnutls: Vulnerability in GnuTLS certtool template parsing

🎯 Affected products20

  • Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:5a9b2a273a676301e4270312e5d03b2b19222d95ee0f95583fd1eedc956078cd_arm64 as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:684398687e17d2eff4f713eaee18dea22bbe3285334bfad0d9812fab51c300a8_s390x as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:9394923ea473b90739587a7f90ec269963ec5ce399520d8f626d63ad1357a0a2_amd64 as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:d3f279fb0bf1b0e13fce85af7a3976149023cb85faf881bfcf515ae129c3b249_ppc64le as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:0c2ea384ae2c29dbbc965e9c24f1e6e78d2d1922dae44218c7585030c5a7a906_amd64 as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:721cc49763de142a6eba2dd441ba0dc522500d385d65300219be48d2f31f0c74_ppc64le as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:9fa023730bc77721a1d519ecc1a209b6d4c06b29baa3dcbb5f2dff2921c6cf27_s390x as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:4d2f9dc5b2b33ee1c77bbfabcbbb9f4d94d343b04c4de2e4f8b3b81a1f0fd2fe_amd64 as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:6b79ed10423d954d21dd24c9cb1cf507f6e02c2942ace7fa30cf7af2ffaeb631_s390x as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:ce213d48fbefae6b9d5f5a64b79c6ed016afcb646bf7b5742707ed31f9a464a2_ppc64le as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2fa401bf3bd53d4f2b9ad775b266ee897206e632a70e7a661409de7860b810c8_ppc64le as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:9b67425fc074cc2154ac38dd8b5e92e5b2bbd46f8899683a23e9020e62ab5adf_s390x as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:de1c3da36e3258c2b6032bf2e3f89fb2c6018489deab55bf97d2416294e4dcf6_amd64 as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:27ce7c22853f9754b91e91cf9b88f9fb99ceea7b9555724fc36b0dddd83c93a4_ppc64le as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:29f771b5f09b0e33d1c2589166a17368f5eec98e46efbe962ecc7a5c8d9ec923_amd64 as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:6ae4656046c69b9821519e54665d9bc6575f3cf35c3a83fa78b50b7efe95ef53_s390x as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:6968e191b6f06b24febd441bd8b6b2d68236a6cee30a233d1ef6fc1191332204_ppc64le as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:992f1649dfed889b9af86da3dcb91a764dc4a0b5918c4ce0945a0c1f5329dfa5_s390x as a component of Red Hat Ceph Storage 7
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:adaa24cdf0a56c1fbda2f7ac7f977b07dfc8c12654cbdc8d9dc5c020b2736056_amd64 as a component of Red Hat Ceph Storage 7

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, ensure the SSSD Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is configured and the an2ln plugin is disabled by adding "disable = an2ln" in a krb5 include file, for example /var/lib/sss/pubconf/krb5.include.d/localauth_plugin and make sure it is included in the Kerberos configuration. Apply vendor updates and follow Red Hat guidance for SSSD hardening. Workaround: Do not process untrusted files with the libxml2 library. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (16)