Red Hat Security Advisory

RHSA-2025:23225

Red Hat OpenShift Dev Spaces 3.25.0 Release.

Released 2025-12-15 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/openvsx-rhel9, registry.redhat.io/devspaces/pluginregistry-rhel9 +3

Fixes 7 records

TI-2025-40938 CVE-2025-66516 · GHSA-f58c-gq56-vjjf

XML external entity injection in Apache Tika core

CRITICAL 85

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA fi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89024 Published 2025-12-04 Fixed in 2.0.0, 3.2.2 CWE-611

TI-2025-34970 CVE-2025-55315 · GHSA-5rrx-jjjq-q2r5

ASP.NET Security Feature Bypass Vulnerability

HIGH 79

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.67162 Published 2025-10-14 Partial fix · 2.3.6, 8.0.21 +5 CWE-444

TI-2025-35172 CVE-2025-55752 · GHSA-wmwf-9ccg-fff5

Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

HIGH 71

Relative Path Traversal vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.64413 Published 2025-10-27 Partial fix · 11.0.11, 10.1.45 +1 CWE-23

TI-2025-38276 CVE-2025-61927 · GHSA-37j7-fg3j-429f

Happy-DOM has VM Context Escape

HIGH 65

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface.

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00642 Published 2025-10-10 Fixed in 20.0.0 CWE-94

TI-2025-34912 CVE-2025-55247 · GHSA-w3q9-fxm7-j8fq

.NET Elevation of Privilege Vulnerability

LOW 35

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00622 Published 2025-10-14 Partial fix · 8.0.21, 9.0.10 +6 CWE-59

TI-2024-03787 CVE-2024-4067 · GHSA-952p-6rrq-rcjv

Regular Expression Denial of Service in micromatch

LOW 33

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01429 Published 2024-05-13 Partial fix · 4.0.8 CWE-1333

TI-2025-34913 CVE-2025-55248 · GHSA-gwq6-fmvp-qp68

.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability

LOW 27

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00736 Published 2025-10-14 Partial fix · 8.0.21, 9.0.10 +7 CWE-326