RHSA-2025:23227HighCVSS 6.2

Red Hat Security Advisory: Red Hat Ceph Storage

Published
December 16, 2025
Last Modified
August 26, 2026

🔗 CVE IDs covered (3)

CVE-2025-4598 →CVE-2025-9714 →CVE-2025-59375 →

📋 Description

CVE-2025-4598 — systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump CVE-2025-9714 — libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

🎯 Affected products25

  • Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:79e38083033e50288fb6dd6ecca312217f0876b50d8131c7c4c77ecc647bb4af_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:ac21a72147ce641191ac615abc8961e7df3055c99a44fabeb41da2934df19c01_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:d0c3f7c75a0ebda0ce2955a0c309e3dd55384008eb0bf4bc003cab0277109116_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:d69c42d3d38233336baff3ba13df429d68ac6a3a17ba1f4a170e2d1188c2e713_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:02292547622e11d0c94aca81752cc42129f8083cc2ae6e11ade8d1a5d604f278_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:8745e83f9a273994364c65a2ab6082ab61a80af05c4e1c53d23e8733126ff93b_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:a5d8d89e337645107c9b417ebf2d53424f3c2a0d5815f28ad417c1956e50a4da_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:cec72610bc57414cba82f7089059af4408d7c51022c15bd0214e03a1c313e950_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:6e64e0e65a871117cff35f0eba405b311ac1d6ec3ccc2621d61d3811a873e0b4_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a05f9ecd070a8a1ac7c8ba56d5551642f81d275f54f0af45e0ecb6e46103d4f8_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:b09eb0a1d99e655de562919ded095bbb5dc65961e341a54ea59ad99b55ca9b1b_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:c95ae228c11ea94b9c111d80df530af10f4a0d9198ccdf03b3685b9413b96fa8_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:3fec552f78ea9f55542c03b2f33c6570fb8c5797c3e451e094a8c738fd36b770_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:406c4983912bdf9bc780d331e769dd8ee0257905ac2fd172483d930852a4a5ae_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:7351e8e9218e7b8f6e8d650d2ff67c47973c8ee5f9b517aa8c11b6d0e15fe4b7_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:7e430d1c3a06d91113969a5e7bc9c0fd1f988a7cd5e1c3c1e71914487ecb3843_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:6d85a2952b9cb9f7ff6da582e52fd04956be649e635f5ebd3d4237ce113693e5_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:c484d4cbc9e5f07741a8db0f99c339e9179bf2e9a0bb9c923c91dcad39fc45d7_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:cbe4b44f0d233c50d0ce1521930904da6a69544515892fd127bec07fc880d0d3_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:e2c2f26eac8dcfe65708cdef57188787a068ca5d40941ed1a3efef2ccd0ca8be_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:0ec530e79c8620d187afcbeac1ecf3780f3322c9b7500d0ab4d27f1df6b9ed18_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:1355bc1d05962b49c060ab216ef71e8576a85748aa0847980a9e22d3a8124dea_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:32c461ce7fc4516c540a53a2f551ae6fa2eccfebac5ce24f478dba6777fb913d_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:9ff3fcb6301eee1f3d21573d10521983f90e83535f46e217fce43c937fa8bf1d_arm64 as a component of Red Hat Ceph Storage 8

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: This issue can be mitigated by disabling the capability of the system to generate a coredump for SUID binaries. The perform that, the following command can be ran as `root` user: ~~~ echo 0 > /proc/sys/fs/suid_dumpable ~~~ While this mitigates this vulnerability while it's not possible to update the systemd package, it disables the capability of analyzing crashes for such binaries. Workaround: The impact of this flaw may be reduced by setting strict resource limits to the stack size of processes at the operational system level. This can be achieved either through the 'ulimit' shell built-in or the 'limits.conf' file. Workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.

🔗 References (7)