RHSA-2025:3932HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.20.0 release

Published
April 16, 2025
Last Modified
September 17, 2026

🔗 CVE IDs covered (3)

CVE-2025-22869 →CVE-2024-12905 →CVE-2025-22868 →

📋 Description

CVE-2024-12905 — tar-fs: link following and path traversal via maliciously crafted tar file CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh

🎯 Affected products41

  • Red Hat OpenShift Dev Spaces 3
  • devspaces-tech-preview/idea-rhel9@sha256:4e822fa90a85d0321e809dc028f6a72b1e47a3bb7173143d79206b9b8af55b7e_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces-tech-preview/jetbrains-ide-rhel9@sha256:1213f967cbe599166dcaa07280cf27c48cbb5c3e2828df278090fb1aa4636c8c_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces-tech-preview/jetbrains-ide-rhel9@sha256:13e0884bb5ae5129350025beea1cbd2a6fdd9087718f6e085738a048629519b9_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces-tech-preview/jetbrains-ide-rhel9@sha256:c2322954825785303dc48f29c5176bc173f58ab3215b0c710000bdcee08458be_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/code-rhel9@sha256:d956ac914d55184d56a5f5dee491254f5267c0fbc984a1171429e3a234872a84_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/code-rhel9@sha256:e0ddb90fb05f486b80fe1c0e7222bc6dd90071f762ab8fd8cfc45a39faa020b0_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/code-rhel9@sha256:e10c4f241fb1dfa9437e453b65ed57ca79550e487f16bc6742d6c1359824dcc0_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/configbump-rhel9@sha256:0b605af925e0664d9f6a89c2460cbe56b6af3979bc394e97518a1ce64756dccb_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/configbump-rhel9@sha256:3ece40e4a3862dc29d9bb41f407117fc52db2ca8208a1dabe82eea28e7a9ba29_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/configbump-rhel9@sha256:effcd9952d7714b29c9496cf632d8e8ad1f5e1fffe4a46e59d57da42490da840_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/dashboard-rhel9@sha256:63c5caa6688b3aae3aee9c58e497b1afc7b9b0638eb83a3627eed3004fca11c3_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/dashboard-rhel9@sha256:f3066189610abf7be0b9d2e827a108d6cdfcdd1a26dea8bb426af669b40d12ff_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/dashboard-rhel9@sha256:f99e4373e39a70c99f4c67cd1a10483c99310e478e5a8b840ab114d11ed2ebd3_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/devspaces-operator-bundle@sha256:091d2d34fbd525a7e9b2c4b1b8eef5283039dfcaac597bece9f4ad0236d1cbf9_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/devspaces-operator-bundle@sha256:1bf0e4367621ed8fef30b5fbd6fbffa59731ecb20cbb8c9772015f8958198a16_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/devspaces-operator-bundle@sha256:a577adb2dbaddcf1ebdcec2a7c4d0a6b3a948fcf55d9890749f1605e8142b8d8_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/devspaces-rhel9-operator@sha256:1fe43138f2ee8603e1f7aa2f9ade87a09099312836b79b606f09c6ded655c2a2_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/devspaces-rhel9-operator@sha256:c3ad009df338a94aed8ca3d4d069bee447ce8b64291bc702fcfa408429108a80_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/devspaces-rhel9-operator@sha256:d08147821133be235c9048e9b815576d38560f8e9745d64cf6ba1123dc3e3f89_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/imagepuller-rhel9@sha256:01217396dfa1ffa44e9cf6b384093a7b6946135fd8fa122083ac6062a3790a2d_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/imagepuller-rhel9@sha256:6987db3152cec7edcf50dbe86d50a5dcdb4923b0879212711b062718a1e4b162_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/imagepuller-rhel9@sha256:ef04c7de41b9b0f5b53d7a8ac39121c509070a6023d75c1cf8f32301ab356567_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/machineexec-rhel9@sha256:134c31698768c99170eb6d27d6283b5f18459dec70fda9137ec0aac2ac60c324_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/machineexec-rhel9@sha256:be8e49378081f05fafba369f406d1cd211ca49e8fac21ce25176ab543094ae13_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/machineexec-rhel9@sha256:ea043fb015e82632de477f17a94e0b9dd31b34312c0214fd2b8128e0d71ba716_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/pluginregistry-rhel9@sha256:54de6ce2c4b3a652b5af186490c65a07c4434d253548596f355b3cd3d4f1bd9b_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/pluginregistry-rhel9@sha256:f9d32726831f630601ad041898282bb5eaa50e81d6f8aeae6cf4a6fe272c37a6_ppc64le as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/pluginregistry-rhel9@sha256:fdd3cdce6f5d0308b19f84dbe31b746c3400c67b675a173e8062dfa593290e51_amd64 as a component of Red Hat OpenShift Dev Spaces 3
  • devspaces/server-rhel9@sha256:7e1b73c1d0ba5325bc430c8d01efa1e563f09bb34c1a88a4cf77a9001c7e955a_s390x as a component of Red Hat OpenShift Dev Spaces 3
  • +11 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers.

🔗 References (7)