Red Hat Security Advisory

RHSA-2025:3820

RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release

Released 2025-04-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9

Fixes 5 records

TI-2024-30407 CVE-2024-45337 · GHSA-v778-237x-gjrc

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

MEDIUM 53

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03181 Published 2024-12-11 Partial fix · 0.31.0 CWE-285

TI-2025-16741 CVE-2025-22869 · GHSA-hcg3-q754-cr77

Potential denial of service in golang.org/x/crypto

MEDIUM 41

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but nev…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00939 Published 2025-02-26 Partial fix · 0.35.0 CWE-770

TI-2025-21540 CVE-2025-30204 · GHSA-mh63-6h87-95cp

jwt-go allows excessive memory allocation during header parsing

MEDIUM 40

golang-jwt is a Go implementation of JSON Web Tokens.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00811 Published 2025-03-21 Partial fix · 4.5.2, 5.2.2 CWE-405

TI-2025-16740 CVE-2025-22868 · GHSA-6v2p-p543-phr9

Unexpected memory consumption during token parsing in golang.org/x/oauth2

MEDIUM 40

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0087 Published 2025-02-26 Partial fix · 0.27.0 CWE-1286

TI-2025-20001 CVE-2025-27144 · GHSA-c6gw-w398-hv78

Go JOSE's Parsing Vulnerable to Denial of Service

LOW 35

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00399 Published 2025-02-24 Partial fix · 4.0.5, 3.0.4 CWE-770