RHSA-2025:22620HighCVSS 9.0
Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.22.1 Release.
🔗 CVE IDs covered (1)
📋 Description
CVE-2025-12548 — github.com/che-incubator/che-code: Eclipse Che — unauthenticated RCE and secret exfiltration via TCP/3333
🎯 Affected products6
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
- registry.redhat.io/devspaces/code-rhel9@sha256:3de7dd8077a9201eb7ff56c340629184773d6c06de9d6e083e13c5b51a82009c_arm64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
- registry.redhat.io/devspaces/code-rhel9@sha256:440ace081a499e93a4966ebfcf1e38302a66e32bea74876db994d71cd3c29572_ppc64le as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
- registry.redhat.io/devspaces/code-rhel9@sha256:e3945f59779f919af98216d0e8424a96a2c8b89bcce06c306adf2b491c061b15_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
- registry.redhat.io/devspaces/code-rhel9@sha256:e617fc6d1cf09cc3a27898b278ddb0c00f3e9d619f93c927e71c9b4a3a3cdf36_s390x as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
- registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:5c9b486f75808ed8d4c75062d11eb3692a6e6c7b476ee47ab7c6cba943cd2596_amd64 as a component of Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
✅ Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Apply the security best practices from the Red Hat OpenShift Dev Spaces Administration Guide: https://docs.redhat.com/en/documentation/red_hat_openshift_dev_spaces/3.24/html/administration_guide/security-best-practices
🔗 References (5)
- selfhttps://access.redhat.com/errata/RHSA-2025:22620
- externalhttps://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.22/html/administration_guide/installing-devspaces
- externalhttps://access.redhat.com/security/cve/CVE-2025-12548
- externalhttps://access.redhat.com/security/updates/classification/
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22620.json