Red Hat Security Advisory

RHSA-2025:3906

Logging for Red Hat OpenShift - 5.9.13

Released 2025-04-16 · Red Hat rating Important · View on Red Hat →

Fixed in

RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9

Fixes 4 records

TI-2025-18855 CVE-2025-25186 · GHSA-7fc5-f82f-cx69

Net::IMAP vulnerable to possible DoS by memory exhaustion

MEDIUM 62

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00626 Published 2025-02-10 Partial fix · 0.3.8, 0.4.19 +1 CWE-1287

TI-2025-20419 CVE-2025-27610 · GHSA-7wqh-767x-r66v

Local File Inclusion in Rack::Static

MEDIUM 41

Rack provides an interface for developing web applications in Ruby.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01173 Published 2025-03-10 Partial fix · 2.2.13, 3.0.14 +1 CWE-23

TI-2025-21540 CVE-2025-30204 · GHSA-mh63-6h87-95cp

jwt-go allows excessive memory allocation during header parsing

MEDIUM 40

golang-jwt is a Go implementation of JSON Web Tokens.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00811 Published 2025-03-21 Partial fix · 4.5.2, 5.2.2 CWE-405

TI-2025-20001 CVE-2025-27144 · GHSA-c6gw-w398-hv78

Go JOSE's Parsing Vulnerable to Denial of Service

LOW 35

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00399 Published 2025-02-24 Partial fix · 4.0.5, 3.0.4 CWE-770