RHBA-2025:3653HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.11.10 bug fix release

Published
April 14, 2025
Last Modified
September 17, 2026

🔗 CVE IDs covered (4)

CVE-2025-22868 →CVE-2025-22869 →CVE-2025-27516 →CVE-2024-6827 →

📋 Description

CVE-2024-6827 — gunicorn: HTTP Request Smuggling in benoitc/gunicorn CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27516 — jinja2: Jinja sandbox breakout through attr filter selecting format method

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:22ddd4f1927d5f589caf07f8fa568499c574ddecb6eafc24a407b00787d37431_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:ac9f53b674d1887928a6758edb8235181f10d8fde111ffa531ae9374794fa48a_ppc64le as a component of Quay v3
  • quay/clair-rhel8@sha256:b5180464a990defad5f7ae2a5f2d82094d360742d1c2646c85f025b4c682935e_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:3ed39839c90b70eaced9257957f6bbf839c9ed154600e8ac08fc9c4f53556720_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:51dea3fb51f1b05298f06678907054a8587f3c06d2ac7b395f431f8ec1dce28d_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:58f341053c69f68dad585211b92356d193930b7814a47280f82ceab20e995ec2_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:58c1557d423551adb1ee43ce0d932c6113e3355cea964cc84009c61886dda832_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:a0d5bb4b2eff25c1949fb37d993e12654f9cf6ffd9fbcd71c210fc6bb5330b40_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:f5f97906816269fb4098d777c8dbfcb95cccc4cc58ce840cb133c12fe670c1d0_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:00e4f1fa04d57fa568a21f5e2940f42df6cb023971c6f2d94cde8d31b43339ae_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:b5df4fefdb021961cd4c0786b15ba76ff2cc124d411ad990945e3bc6825b566d_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:e4ca752aa637d6f0cf9b9cc8f0cacdef1636157c936c66708e0163bdb5654892_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:893015395b4d019e4f7b80797c76e3fb7be93fde2efddb5788ce7797345272dd_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:92d2032535ea3224454605049096b0d90f927818a0626437e3b0e5b81f65279c_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:93710fc81ed3fc2dea577b580b469c311bc874b1cc9a770af9c5f318aeb3f80a_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:2958154bf0dec8afad5277c1fca990e324d3e95727493e7d76a3049a63e760bb_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:78fc77b254d1c522853cb62c502bc9099593690a4fabd2120596f496627d5ac7_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:ed8900f8cd002ae1fc36abd98984ef43616399886fc0b60988d2fed1a667d450_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:05d86cd0b528ddd3079973f0e63e23024ffab0a49ff5e15f6849f6fa3576f817_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:2241cd14f1fc28244ff4b2f6fb0cb2a63cb01c6b2d909ca74164ab133f25912e_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:50b8ae1f66055a59b8a0db0d77e35a01e3edfab81a033cfe1c648ed3dc3c3db6_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:326c7bc3909c390a9a2265447c34f8868fb677d3d99d4c98473b665c1620ecf6_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:5755f7f1c44f0ba928f07746ae58a19915d7e57e6929bd5e0daaed8d511f88e6_ppc64le as a component of Quay v3
  • quay/quay-operator-bundle@sha256:9241d9983d0ecdd81df219c94d84af350da3ae15e05a31ff941554f34a562d64_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:50c6f827765ef339d45cfb46ceb01b4935ff41e6d1ff885ef1f59b6145d7e959_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:b88115249084734bc0b1b4dd30a02ba18d30d2f47671b2658eba85b47d8079fa_s390x as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:d04105b879d916c470d5a85e853763ea23b75b90d9f01bdf039090536f1f304a_ppc64le as a component of Quay v3
  • quay/quay-rhel8@sha256:113a87febd958ee9777287c5253bb28d35bad177080ac6c3f486f909b89304a6_amd64 as a component of Quay v3
  • quay/quay-rhel8@sha256:17b95f994014c59921e252840404a2b99941e3e0063dc73d6f045f43d2be8efa_ppc64le as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat Product Security currently does not have a recommended mitigation at this time. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers.

🔗 References (2)