RHSA-2025:23064HighCVSS 8.2

Red Hat Security Advisory: Red Hat Quay 3.10.17

Published
December 10, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (6)

CVE-2025-47913 →CVE-2025-59420 →CVE-2025-61920 →CVE-2024-34156 →CVE-2024-45337 →CVE-2024-45338 →

📋 Description

CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-59420 — authlib: Authlib RFC violation CVE-2025-61920 — authlib: Authlib Denial of Service

🎯 Affected products32

  • Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:83c5ad5ebfdd1b389af2fd407d8d6b8da52805cb3212bb2916108001296bb642_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:9403e73ee33102c2f18bcaca03e8eae21a283e47a4f288150db4d105a90b6b8f_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:bb630cb6e6bad937624d772e49a795da457035c7dcb1740c07d54a36f561ad79_arm64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:fec577bc00c5dc32b284c30fb0d2e324a12d0f932b9abf65e70256e3d80bcda8_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:8b475114a5f77f7c041509a30246769a5f9064510724c8fc99ac29164dc3a0bb_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:892bee6e3214a69b8924f840b69a55ac0c8d66443bf042cfa88c13766bd8dce3_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:aa126c3f4865a2a62cba2734110418c865aa2d32f38147c056732e53fc593715_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:b9889747f06f6fe48cd1a79aaf6dcafcf6a9cdd2d2ad986fb10da3f2a51c103b_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f55014b7e95512e2dcad9ebde4d36a39e136093ed22fc3436e66cf9b34091999_arm64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:42e442bf326bf2039f7ead1d13ba0b47e605fce986c241e6fcfca9cc9926b255_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:cf0b723425c76814def9211124d18ce95e58b265185e12c5ae183f9999e51b1a_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:d93675365e51845d5d8a17997395726a4b09952fba42aaccdcfe132fd8e4d31c_arm64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f3223fc2fef5653947f8e402020c7f332beeee7c6a09d9be0bc7dc31ef3936f8_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:25567f02ee5b0640a12f76bfed9b889334363be402d9bdb14c8b7cc37feb6b28_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:6f893e3537bdc8ac814c5726f5594f4da820973d2246d3b399687d406e9a3952_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:bcc3f8c6589b63a0a162498ea2ab3596971a97b9107ade0ebd3e8d0d372ac84e_arm64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:c6dfd40d71e49b352b39595ad73f06002d3bc448bc93e06def96ab3424451893_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b82090e9203982de62d995c18eed37838b8ebbb092195a7f58d02526fd04523e_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:03da6ae6711c5238e19daa8ccccd75bc936ab8144b67cb2ccddcd3d1d2e33a40_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:1bd8354520b468f4eb47872a428f56da551e6720f31a41ce6e02df5050b4f8b2_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:ab3aa3fde12c94c24c2c1a3caa08f5d995cc9d3d9cca1af8b46610f6b4ff28ee_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c7c2192a046c0fde35dcafa363803c085663676224708f4520fd967b3d2c8dd4_arm64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-bundle@sha256:91ce9e64184afb90b00360c64f5ba37d30130ab0344b2439b93db15f2b35b74d_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:3940beeed21aa2c4ae695e7ac40a0373a05246f1dff2d6d829d3111c032a1970_arm64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:96ee14d79f08194aa54cc7e6d1d814dae5af1d7143e513b6f1cb9397b6407ae6_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:cfbfd35f7cd15df266c69d12975f64db2bc38238d2a0a7f9d17b319db20ccbbb_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:e83662cd7bab21bcd0faa26ae67f0cb9244a67e17036af92cf30fe2a5591dcb0_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:2b5f83bbade40b04a7975788743afdb8cec5f72ad8e5eea4c75d5840ce44ef3f_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:7b77b205b95f99383f12e571b391a35ea8f85dfd23f2d4fd67045bbece1ee66e_amd64 as a component of Red Hat Quay 3.1
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Users unable to upgrade may manually enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.

🔗 References (9)