RHBA-2025:3651
Vulnerability from csaf_redhat - Published: 2025-05-09 17:08 - Updated: 2026-08-12 21:33Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.13.5 bug fix release
Severity
Important
Notes
Topic: Red Hat Quay 3.13.5 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.13.5
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Gunicorn. This vulnerability allows request smuggling, leading to cache poisoning, data exposure, session manipulation, Server-side request forgery (SSRF), Cross-site scripting (XSS), denial of service (DoS), data integrity compromise, security bypass, and information leakage via improper validation of the 'Transfer-Encoding' header.
7.5 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, ".")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.
7.5 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the golang.org/x/crypto/ssh package. SSH clients and servers are vulnerable to increased resource consumption, possibly leading to memory exhaustion and a DoS. This can occur during key exchange when the other party is slow to respond during key exchange.
7.5 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Jinja. In affected versions, an oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker who controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox.
7.3 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
29 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.13.5 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.13.5",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2025:3651",
"url": "https://access.redhat.com/errata/RHBA-2025:3651"
},
{
"category": "external",
"summary": "PROJQUAY-7579",
"url": "https://issues.redhat.com/browse/PROJQUAY-7579"
},
{
"category": "external",
"summary": "PROJQUAY-8692",
"url": "https://issues.redhat.com/browse/PROJQUAY-8692"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_3651.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.13.5 bug fix release",
"tracking": {
"current_release_date": "2026-08-12T21:33:45+00:00",
"generator": {
"date": "2026-08-12T21:33:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHBA-2025:3651",
"initial_release_date": "2025-05-09T17:08:35+00:00",
"revision_history": [
{
"date": "2025-05-09T17:08:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-05-09T17:08:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-12T21:33:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"product_id": "quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.13.5-8"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.13.5-6"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"product": {
"name": "quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"product_id": "quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.13.5-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"product": {
"name": "quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"product_id": "quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.13.5-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"product_id": "quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"product": {
"name": "quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"product_id": "quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.13.5-25"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"product": {
"name": "quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"product_id": "quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.13.5-6"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"product": {
"name": "quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"product_id": "quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.13.5-17"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.13.5-8"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.13.5-6"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.13.5-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"product_id": "quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.13.5-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"product_id": "quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.13.5-25"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.13.5-6"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"product_id": "quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.13.5-17"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"product_id": "quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.13.5-8"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.13.5-6"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"product": {
"name": "quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"product_id": "quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.13.5-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"product": {
"name": "quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"product_id": "quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.13.5-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"product_id": "quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.13.5-5"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"product": {
"name": "quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"product_id": "quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.13.5-25"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"product": {
"name": "quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"product_id": "quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.13.5-6"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x",
"product": {
"name": "quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x",
"product_id": "quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.13.5-17"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x"
},
"product_reference": "quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le"
},
"product_reference": "quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le"
},
"product_reference": "quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x"
},
"product_reference": "quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le"
},
"product_reference": "quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x"
},
"product_reference": "quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le"
},
"product_reference": "quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x"
},
"product_reference": "quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le"
},
"product_reference": "quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
},
"product_reference": "quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-6827",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2025-03-20T11:07:09.471036+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2353700"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Gunicorn. This vulnerability allows request smuggling, leading to cache poisoning, data exposure, session manipulation, Server-side request forgery (SSRF), Cross-site scripting (XSS), denial of service (DoS), data integrity compromise, security bypass, and information leakage via improper validation of the \u0027Transfer-Encoding\u0027 header.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gunicorn: HTTP Request Smuggling in benoitc/gunicorn",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-6827"
},
{
"category": "external",
"summary": "RHBZ#2353700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2353700"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-6827",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6827"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-6827",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6827"
},
{
"category": "external",
"summary": "https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7",
"url": "https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7"
}
],
"release_date": "2025-03-20T10:09:55.725000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-09T17:08:35+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:3651"
},
{
"category": "workaround",
"details": "Red Hat Product Security currently does not have a recommended mitigation at this time.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gunicorn: HTTP Request Smuggling in benoitc/gunicorn"
},
{
"acknowledgments": [
{
"names": [
"jub0bs"
]
}
],
"cve": "CVE-2025-22868",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2025-02-26T04:00:44.350024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2348366"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `golang.org/x/oauth2/jws` package in the token parsing component. This vulnerability is made possible because of the use of `strings.Split(token, \".\")` to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-22868"
},
{
"category": "external",
"summary": "RHBZ#2348366",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348366"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-22868",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22868"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-22868",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22868"
},
{
"category": "external",
"summary": "https://go.dev/cl/652155",
"url": "https://go.dev/cl/652155"
},
{
"category": "external",
"summary": "https://go.dev/issue/71490",
"url": "https://go.dev/issue/71490"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-3488",
"url": "https://pkg.go.dev/vuln/GO-2025-3488"
}
],
"release_date": "2025-02-26T03:07:49.012000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-09T17:08:35+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:3651"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws"
},
{
"cve": "CVE-2025-22869",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-02-26T04:00:47.683125+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2348367"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the golang.org/x/crypto/ssh package. SSH clients and servers are vulnerable to increased resource consumption, possibly leading to memory exhaustion and a DoS. This can occur during key exchange when the other party is slow to respond during key exchange.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "While this flaw affects both SSH clients and servers implemented with golang.org/x/crypto/ssh, realistically the flaw will only lead to a DoS when transferring large files, greatly reducing the likelihood of exploitation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-22869"
},
{
"category": "external",
"summary": "RHBZ#2348367",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348367"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-22869",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-22869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22869"
},
{
"category": "external",
"summary": "https://go.dev/cl/652135",
"url": "https://go.dev/cl/652135"
},
{
"category": "external",
"summary": "https://go.dev/issue/71931",
"url": "https://go.dev/issue/71931"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-3487",
"url": "https://pkg.go.dev/vuln/GO-2025-3487"
}
],
"release_date": "2025-02-26T03:07:48.855000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-09T17:08:35+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:3651"
},
{
"category": "workaround",
"details": "This flaw can be mitigated when using the client only connecting to trusted servers.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
},
{
"cve": "CVE-2025-27516",
"cwe": {
"id": "CWE-1336",
"name": "Improper Neutralization of Special Elements Used in a Template Engine"
},
"discovery_date": "2025-03-05T21:01:07.674606+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2350190"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jinja. In affected versions, an oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker who controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja\u0027s sandbox does catch calls to `str.format` and ensures they don\u0027t escape the sandbox. However, it\u0027s possible to use the `|attr` filter to get a reference to a string\u0027s plain format method, bypassing the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jinja2: Jinja sandbox breakout through attr filter selecting format method",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as important severity due to the potential for an attacker to bypass Jinja\u0027s sandbox by exploiting the |attr filter, by controlling template content, an attacker can execute arbitrary Python code, impacting the integrity, confidentiality, and availability of the system. While the attack requires user interaction to trigger untrusted templates, the risk is significant in applications that allow such templates to be executed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-27516"
},
{
"category": "external",
"summary": "RHBZ#2350190",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350190"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-27516",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27516"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-27516",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27516"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403",
"url": "https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"
}
],
"release_date": "2025-03-05T20:40:06.568000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-09T17:08:35+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:3651"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:7298f17b3894c919dc271dc60907ce22d53abf9727554ea50e52ee9f8bce73dc_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:92715751aef8fce39ba0e97d1a75a65b8d1ae7106d62486a1794b4d9bddbd687_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:a4b5b1c45db5708481908e024f7160cbe27e66d975e12f275cb02fbfeb08207b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:12242be8a33acdc8683b39fdf8e007baf7a35302527807eb0037d0ccef1cfe27_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:841fd2c720b174e3a6df84cb77350c8dbe1d6057198fbe372455fd9a776ae4ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8a4f63f5d129f75c3f53cea7bfd460df44f0f040e92663207c34bdb77255eebe_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f494815365be08391ec325271c44100fb6167fb15ccf1c4155c7a0a6197b89b_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:d883983710064b866467b4db5766bcfefea8009895eae797e11f2663d0929544_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f871b4ba1aae82f6a635bc850219313b2118f75d8609c513f2d3846be208a561_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0675d303e2a70ae0ae3133095e13c7ed630d02ce77ac83cee016e1b16a951971_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ae4bef78094c03b766f1a47d4ff0f02302797455a28f7a15fa21ef50d31e026d_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:cc7ee29566143a2a0f61b1deb93687d28d3e13148afb833e93a37798d0f4dc32_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:254c389896555730eeeae17cb03ec6afc3230883bb2ac9c5722388a4d2de6ab3_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:4b730e73b8762a4e994d4d428c7ca96ec18c5480bbd7d5fdbfbeef0419c1b8ce_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:b4f9dba37bf482ef415d5fbc233329ea13c9087dfd5a97cd6dbe0e85d0d1aa40_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:30f8e7bc7a7a72882720cd329dd8d9cebcb0dac3da04e211281129a88992f544_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9c0f9fd196b3b90c04ce314caa3730736b99edc2762d48cc2f998197ecfbd4d1_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9ea22d519c7b086e27077f935590abc1d9ea2ea1a8db0ebf33ce2383d4b5775b_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:34d3081bb600b37cc70827b341d2c54ffe5c6a973f19744ed3b5792e2ffb80b8_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b4e155c030b5f4dd8d84888262f6957ff261ec3ab6f484f04445c248bbd16594_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:ca7062b086a57567b9a00b337c1b0d541c9886873f5de59a6408280e5b6e706c_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:324e423b8bccb370ef85f9886515caac1c87fd36a8989dcfdaebda3e8f1062b1_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3a6a4e98b434edc29e8ffa69d500e174e9003fec10559650b295bef3c8b0aa4a_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:635ec8aa2cbd5a2387656f615f1ffed7b54845df47780363c42383cdefc20196_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4b8672d738c80f4aac2f66d740678938acea9b7509cb1746b81cdb9e728608f0_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:c6b4d012500b017e0b3265eb9d1c1fb771d30e9a354f572362f69a6bf8f88a00_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e4ded1509a87c90f95f3fcddf4083b79929f5ec34ba7bb90741e8654691cdf2e_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:11b133caf63b6543ecfe545c593941313ad5c62dd9ae1b3d6411e4a281321835_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:35fa842fb2449cec085c3481f640d799a6883ed330f30cf352458fdcf8fe5eae_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:d915acc24d3e3ff524edd9979cb796995afe4eae97c39a3131a04f480ef82770_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jinja2: Jinja sandbox breakout through attr filter selecting format method"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…