RHSA-2025:7616HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.3 Bug Fix Update

Published
May 14, 2025
Last Modified
September 6, 2026

🔗 CVE IDs covered (2)

CVE-2025-22868 →CVE-2025-22870 →

📋 Description

CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22870 — golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

🎯 Affected products109

  • RHODF 4.18 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:3136e58c7368b1b9a295cf5773764b8e293d6324bbd05260065bf99daa947b2b_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:cabb40ef208de9349c54c809ff80a8ee1cb6bcc9fd5f3e2b24f4acb837ab6229_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:e3e446b3966b18ced726f34bc805269af9ccbaa5c502af0c8ebd912579c3b786_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:0337208d961a29afd5fef0b4272f753d00acb00da7e29dc9b91aa48b4cc8e79d_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:32dfa181892e0099f1b0a641b89f7179b8539541f9c3aa8270fd3fd6f53af0f0_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:48f8800dd95f12cf3e4846646da7b2d4658810ca7e54e711c9e9b738f98b8386_arm64 as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:86fcf3ccfb9a8f9ac98f7b874de0bae433b9e2d6eea67cd8fed840b7b9b70411_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:6b8ae0dfc15bf2b7c52a41dfac42c221b5630783a35000ab00303f2dfb371e95_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:845556d5d8fc2b5e56424219d99d07db672e352cd5d9801d2fec6d13312b99dc_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:fc167c03fcd29f8e1a41ea9f6b4dc5803c4f68d8bfff3cbd983734b227b80f2b_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:181a7ce1056d741b07baeb66146f4dbc623131047c2424b3b66c4e98bcdedf31_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:333f3c838a1b8a0c5d8a528bc249f02f8bb016ba225970acac6bd23102868dad_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:498767d6cbd4ad191d5d9e36a0d13710891828ab016d3723e5c88eba74b039f8_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:e94338a1b7186d2dd35fb76a1e69ac47b74c90317e5962d71a0bc3d2ccf02c93_arm64 as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:163dc8947f4a44c40ca33b054a98bd8a232cbb94836054451610ded06ebae183_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:2488f57417b3113bdc6143401aaf7d7d7054e6c56685d9d8f88a9a48cc8323d8_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:e6f3079508f74bde0016ab97316c270ec99192447a001ef5dbf9d6b683a0c4e7_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:24f76ffd03f581af581ec5fee5f3aeb8a925f9c7a7aba54f298b427af0a578d0_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:32c51da4f1081e65033e2fabbfebffe75fdbee613c92642b2348223f1652d65f_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:43a07d71a922a0f97b1699be082c6069e91ff3ee83bc92f340c50dfa992d1c24_arm64 as a component of RHODF 4.18 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:8a0ba5e32d8b8b594a7d848a2e0446d81b6564f48abc6dcec82e26c355926e79_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:6fd3c48b553ff95956edb4263ef62a51aeccbb977fe2666805477edd32ef6050_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:9d238b532036351dfda5fe50a5dfb602683c2f595bcbf5359dbea989524c5af1_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:ea8c9a6dc2a691b299bcc71b6045a24dee57e15860aadb6cadbcb33e02289c6f_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:1bd6244f93fd2eb2beaada8cbb39382434fbde3f75a0940690977058acdb302c_s390x as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:84d32f0a9c87ce4a4e61216f927093054e6fd76eed8ed7ab77e8fa43f989d2d2_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:f72f0e4fddc76a887adb68ba6dacb1ffcea2a461fbda9ae491311f291201eeb1_amd64 as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:9efc9b68956feb2b873afd78722b7a2bd404146395b85a205b6b26e8f810b54a_ppc64le as a component of RHODF 4.18 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:9f644233139872375b89682eb561a23b2be62de5f51fbdf473e097646bfa9133_arm64 as a component of RHODF 4.18 for RHEL 9
  • +79 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)