RHSA-2026:15979HighCVSS 7.5

Red Hat Security Advisory: Red Hat Ceph Storage

Published
May 11, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (7)

CVE-2025-64756 →CVE-2025-68156 →CVE-2025-13033 →CVE-2025-47914 →CVE-2025-58181 →CVE-2025-61729 →CVE-2025-64718 →

📋 Description

CVE-2025-13033 — nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict CVE-2025-47914 — golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages CVE-2025-58181 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-64718 — js-yaml: js-yaml prototype pollution in merge CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2025-68156 — github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation

🎯 Affected products29

  • Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:3d4903b8dbe33464c05ce219ee2e945bf1be169efbed73caee5185883c9df508_amd64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:67d65ecfe844febb7afdfcfbdc0a31f3bd9dfb4c3c81f4734a1b146e34d8d5cb_ppc64le as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:a6a8bbdd49272c632edd96e1598d1e697ba3a1dabb8d36086eced4847de59cbb_s390x as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:c27690e36faf7db08a6d398cce7dbedcfe74848224a179c7278b62315516dd4a_arm64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:02914a917bbea40c35be2cc7dbaf05c5ac1e1bd30b0e82b4ad9a1c58b99a076b_ppc64le as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:2ce063cc246e7694adf066c17390b4c8d95719b2786267a9db64390407648410_amd64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:aeb508e1309d4a811f881f4028e1c370a5431d290aca2c4af5acdf6a58916a7f_arm64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:fa3c9307038f92e351892be9c73cda40a3bab2038904fabcb97dad5568dcec2d_s390x as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:0f37c554cc22c9c89cc4c53739b2ef86e84287486e3f7cdbad10a6e53439d596_s390x as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:1a8207fe81e8c5bd63568eddddb41dd0da16d8340c5f5ae3615fe46ae864a163_ppc64le as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:9e15073c7782b0194c06e0b420573e49d5719002417faa567c99ee8409ff590d_amd64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:f76307e201d0b2deaf0aa96bc6b62fc4535c8358b06a8e95ec5a8abf10d2da07_arm64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:5c496cafb1e21883677c6dcb9fd7392383325b8529b98648af757545dfe59488_s390x as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:b2875bcf5aee1175faa2ab1ce163642e17c4948ff5aa76967d008f75b470fc74_amd64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:df6bf531755753b224999cb9a5f087c96e8a512666589df4763d4a14941a6f5a_ppc64le as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:f7e87de708186099c76426f24b53395340a672e282615164bac73afca3f36454_arm64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:0350448bf1fb15f26c0d092ceb8b0618932f42d30ca4c7c62f2ec1b86c20dd23_ppc64le as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:4c8c8ef82f2f2685d76a9535523c4c93485329aa23328a68426e93789f363b53_arm64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:7fa04ae06b25476b7b2a3f9e21279202571fd8fc5ff5012c980caf3f33edc0a5_s390x as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:8b20b6abf0399bbfc970990bc0c5b6dab46c1043ef761519dbbe8213e6fdd169_amd64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:28aae4d07691c86cdfa9bbfcc7b68e1a3304402ac6c65982bfc0f7945cb9a44e_s390x as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:3b78f446debe56d01cd96dc3c3ae225a982ee6abdd7d2fabae553cf4c87e471a_arm64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:cbc542505b4784050c96b3fb31a4867b5d94c8a6957b54a8cfad03bc16a19578_ppc64le as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:e0e44241bde7bfbccea69d06e5fd00ad0a0ab569bef6645687bcadcfc00aa5ef_amd64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:5ccb9e878551c910e3a300ab8043fdc4788381c9515dc9dcaa965a738d2de059_s390x as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:7559ec0119f673e243361d4e457a8e9687beb3af60a4fd608fa211539b9034c1_arm64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:808082ac26e53bc7f962428d8e67f721654b732eb1d40fc6e272fcb7f045797c_amd64 as a component of Red Hat Ceph Storage 8.1
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:bf282440c8e3ce4d38535bb1efdcbc05f0278647d2fc6e2a13c9c28c0c101f79_ppc64le as a component of Red Hat Ceph Storage 8.1

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Currently there's no available mitigation for this flaw. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled. Workaround: To mitigate this issue, applications using the `Expr` library should ensure that evaluation environments do not contain cyclic references. Additionally, externally supplied data structures must be validated or sanitized before being passed to `Expr` for evaluation. As a last-resort defensive measure, expression evaluation can be wrapped with panic recovery to prevent a full process crash.

🔗 References (11)