RHSA-2025:4250HighCVSS 7.5

Red Hat Security Advisory: RHSA: Submariner 0.19.4 - bug fix and enhancement update

Published
April 28, 2025
Last Modified
September 8, 2026

🔗 CVE IDs covered (3)

CVE-2024-53259 →CVE-2025-22868 →CVE-2025-30204 →

📋 Description

CVE-2024-53259 — quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products37

  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-agent-rhel9@sha256:0d1b411f4e937b7a1a230186188a078eb137fc61111da5f0c5a1d9e6409c0514_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-agent-rhel9@sha256:153e86892abbdd33fb76d6841b59974617e7a4a59a6f60c9607a6dd9c15b1e25_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-agent-rhel9@sha256:9672a743b82e40b777ecb3f2773951ad1858157d34c15d0d2d1ba10c871c5bac_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-agent-rhel9@sha256:cdbd32a25d7e78e387df5fc048e359cb2c3e36d4bc437f1a14383105beeecfb5_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-coredns-rhel9@sha256:0821ae89e222c9c4fd215e44631cb9ed9f2e77e8da6f1498c8e708825fc3c2d8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-coredns-rhel9@sha256:72c566f6c480170a206d9e1434a8b47a9e4d84a9fdb2e312e5d502ededb97afc_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-coredns-rhel9@sha256:c091237cbdb4f818a86bd0bee492e9008793c2446f85bbb0334a98d396edc448_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/lighthouse-coredns-rhel9@sha256:d4f1086f745bc6409cbf38277633bddfef5e0270de4f51b9e88e651d4a3a584b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/nettest-rhel9@sha256:3e649528e81edc73ca8caee8bfa730e2ed1b6cc10c99943724b010d6a56f55a8_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/nettest-rhel9@sha256:6ddff743547d3aa2d0dc93007ca0b6b6f8baacd21eb9a53690f056011a98a764_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/nettest-rhel9@sha256:908cba644740fddf4809135228e23e5ac624625ef3ca1e7d31d3845be1602edd_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/nettest-rhel9@sha256:bf5bdc879ad55b6a4ba0b03b9da575fd982d8e8aafcce60efd29694e5c1a983a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/subctl-rhel9@sha256:1b90a79b648623172805b9eb1a4d63e6429fa79d6b536f3f43443560828c39b2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/subctl-rhel9@sha256:238263fb1af94c9a10cf9339ce6b33413491ed8f6b417f850bef23c12c3d7c7c_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/subctl-rhel9@sha256:369a7e1d76f1fd8401357b78d03b1b2f32573654ddd86beb779d5dfef1f0b0c9_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/subctl-rhel9@sha256:d03dc9e7b5b2134279e464b015442b1db9b091fc798f3b4110d13ff694d560b0_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-gateway-rhel9@sha256:0bfad6a2fd4d557915c44965936bf7ee3ee304ab0e8b8245f0f551030cf566b2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-gateway-rhel9@sha256:b31742bf606a5bb5b05f460eebfa751241c5004e39ba3560ecff6c15f82dbfc9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-gateway-rhel9@sha256:c7f08f3fd694c878fd903090933d3dff9d9dbf713f2696e0fd1231cffef34d87_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-gateway-rhel9@sha256:ed0b594733e2c19e976a2b602eaeb7e9319a115dacf1b1d9619064a485a05d4f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-globalnet-rhel9@sha256:0abe0ef32337853b5cbf5eaaa5c3cf6bbcd5d2c6484cbb265e2c919b8ad17575_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-globalnet-rhel9@sha256:55ac745945e924b38666c6e4e782e428848e0697f7ea20a4ff9d59904a6f9c64_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-globalnet-rhel9@sha256:acd2c964450fe81ca59310593c5c875de75726c8db6b37b2a499f46413babee6_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-globalnet-rhel9@sha256:c8aff2edbed7f183ddb6f5e230e01595741ce6e60c9281c61ccabe62d1e175bf_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-operator-bundle@sha256:5cf619c86ce2d7d8cb8557e74f61f01b9c3f6b4d56737a424d8113e44423b9e8_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-operator-bundle@sha256:a9d4315960012d229c77bb479fd714168418a436eb6bfafc12b3b8e9245839cc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-operator-bundle@sha256:f6de1136ced78ddf1ff48fdadc259c251919dd3a70819fe0e9247411999d51f3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-operator-bundle@sha256:fddfabf50f1ea179034a15385b6ba094171bc6e6340ab2cb05ae9d78f1d8d53c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/submariner-rhel9-operator@sha256:157c9a6fa28e490d4dda85daf246a2fd37abb4b908ecf455acf8d5c688979e7d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • +7 more not shown

✅ Remediation

To learn more about Submariner, see https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/networking/networking#submariner. Workaround: Use iptables to drop ICMP unreachable packets. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (6)