Vulnerability-Lookup

RHBA-2025:8262

Vulnerability from csaf_redhat - Published: 2025-06-09 12:40 - Updated: 2026-08-09 03:55

Summary

Red Hat Bug Fix Advisory: Red Hat Quay v3.14.2 bug fix release

Severity

Important

Notes

Topic: Red Hat Quay 3.14.2 is now available with bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Quay 3.14.2

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-21538

A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64	—	Vendor Fix fix
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le	—	Vendor Fix fix

Threats

Impact Low

CVE-2025-4374

A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2025-21605

A flaw was found in the Redis server. This flaw allows an unauthenticated client to cause an unlimited growth of output buffers until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted, and the memory is unavailable. When password authentication is enabled on the Redis server but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system runs out of memory.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

References

21 references

URL	Category
https://access.redhat.com/errata/RHBA-2025:8262	self
https://issues.redhat.com/browse/PROJQUAY-8633	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-21538	self
https://bugzilla.redhat.com/show_bug.cgi?id=2324550	external
https://www.cve.org/CVERecord?id=CVE-2024-21538	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21538	external
https://github.com/moxystudio/node-cross-spawn/co…	external
https://github.com/moxystudio/node-cross-spawn/co…	external
https://github.com/moxystudio/node-cross-spawn/pull/160	external
https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-…	external
https://access.redhat.com/security/cve/CVE-2025-4374	self
https://bugzilla.redhat.com/show_bug.cgi?id=2364267	external
https://www.cve.org/CVERecord?id=CVE-2025-4374	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4374	external
https://access.redhat.com/security/cve/CVE-2025-21605	self
https://bugzilla.redhat.com/show_bug.cgi?id=2361883	external
https://www.cve.org/CVERecord?id=CVE-2025-21605	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21605	external
https://github.com/redis/redis/releases/tag/7.4.3	external
https://github.com/redis/redis/security/advisorie…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.14.2 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Quay 3.14.2",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2025:8262",
        "url": "https://access.redhat.com/errata/RHBA-2025:8262"
      },
      {
        "category": "external",
        "summary": "PROJQUAY-8633",
        "url": "https://issues.redhat.com/browse/PROJQUAY-8633"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_8262.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.14.2 bug fix release",
    "tracking": {
      "current_release_date": "2026-08-09T03:55:02+00:00",
      "generator": {
        "date": "2026-08-09T03:55:02+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHBA-2025:8262",
      "initial_release_date": "2025-06-09T12:40:33+00:00",
      "revision_history": [
        {
          "date": "2025-06-09T12:40:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-06-09T12:40:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-09T03:55:02+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Quay v3",
                "product": {
                  "name": "Quay v3",
                  "product_id": "8Base-Quay-3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
                "product": {
                  "name": "quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
                  "product_id": "quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
                "product": {
                  "name": "quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
                  "product_id": "quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
                "product": {
                  "name": "quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
                  "product_id": "quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
                "product": {
                  "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
                  "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
                "product": {
                  "name": "quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
                  "product_id": "quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
                "product": {
                  "name": "quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
                  "product_id": "quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
                "product": {
                  "name": "quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
                  "product_id": "quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
                "product": {
                  "name": "quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
                  "product_id": "quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.14.2-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
                "product": {
                  "name": "quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
                  "product_id": "quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le",
                "product": {
                  "name": "quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le",
                  "product_id": "quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.14.2-7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
                "product": {
                  "name": "quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
                  "product_id": "quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
                "product": {
                  "name": "quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
                  "product_id": "quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
                "product": {
                  "name": "quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
                  "product_id": "quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
                "product": {
                  "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
                  "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
                "product": {
                  "name": "quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
                  "product_id": "quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
                "product": {
                  "name": "quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
                  "product_id": "quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
                "product": {
                  "name": "quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
                  "product_id": "quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
                "product": {
                  "name": "quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
                  "product_id": "quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.14.2-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
                "product": {
                  "name": "quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
                  "product_id": "quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
                "product": {
                  "name": "quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
                  "product_id": "quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.14.2-7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
                "product": {
                  "name": "quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
                  "product_id": "quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
                "product": {
                  "name": "quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
                  "product_id": "quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
                "product": {
                  "name": "quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
                  "product_id": "quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
                "product": {
                  "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
                  "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
                "product": {
                  "name": "quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
                  "product_id": "quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
                "product": {
                  "name": "quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
                  "product_id": "quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
                "product": {
                  "name": "quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
                  "product_id": "quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
                "product": {
                  "name": "quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
                  "product_id": "quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.14.2-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
                "product": {
                  "name": "quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
                  "product_id": "quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.14.2-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
                "product": {
                  "name": "quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
                  "product_id": "quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.14.2-7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x"
        },
        "product_reference": "quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64"
        },
        "product_reference": "quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le"
        },
        "product_reference": "quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x"
        },
        "product_reference": "quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le"
        },
        "product_reference": "quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64"
        },
        "product_reference": "quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x"
        },
        "product_reference": "quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64"
        },
        "product_reference": "quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le"
        },
        "product_reference": "quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x"
        },
        "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le"
        },
        "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64"
        },
        "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le"
        },
        "product_reference": "quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64"
        },
        "product_reference": "quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x"
        },
        "product_reference": "quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64"
        },
        "product_reference": "quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x"
        },
        "product_reference": "quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le"
        },
        "product_reference": "quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64"
        },
        "product_reference": "quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le"
        },
        "product_reference": "quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x"
        },
        "product_reference": "quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64"
        },
        "product_reference": "quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x"
        },
        "product_reference": "quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le"
        },
        "product_reference": "quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x"
        },
        "product_reference": "quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64"
        },
        "product_reference": "quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le"
        },
        "product_reference": "quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x"
        },
        "product_reference": "quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64"
        },
        "product_reference": "quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
        },
        "product_reference": "quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le",
        "relates_to_product_reference": "8Base-Quay-3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-21538",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2024-11-08T13:44:29.182678+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2324550"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cross-spawn: regular expression denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
          "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
          "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
          "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
          "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
          "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-21538"
        },
        {
          "category": "external",
          "summary": "RHBZ#2324550",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2324550"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-21538",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-21538"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-21538",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21538"
        },
        {
          "category": "external",
          "summary": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
          "url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff"
        },
        {
          "category": "external",
          "summary": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
          "url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f"
        },
        {
          "category": "external",
          "summary": "https://github.com/moxystudio/node-cross-spawn/pull/160",
          "url": "https://github.com/moxystudio/node-cross-spawn/pull/160"
        },
        {
          "category": "external",
          "summary": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230",
          "url": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"
        }
      ],
      "release_date": "2024-11-08T05:00:04.695000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-09T12:40:33+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:8262"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "cross-spawn: regular expression denial of service"
    },
    {
      "cve": "CVE-2025-4374",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2025-05-06T01:20:45.731000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2364267"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn\u0027t been mirrored yet, they are granted \"Admin\" permissions on the newly created repository.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "quay: Incorrect Privilege Assignment",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
          "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
          "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
          "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
          "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
          "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-4374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2364267",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364267"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-4374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-4374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4374"
        }
      ],
      "release_date": "2025-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-09T12:40:33+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:8262"
        },
        {
          "category": "workaround",
          "details": "Permissions can be updated after creation but there\u0027s no preventative measure before hand.",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "quay: Incorrect Privilege Assignment"
    },
    {
      "cve": "CVE-2025-21605",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-04-23T16:01:41.763906+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2361883"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Redis server. This flaw allows an unauthenticated client to cause an unlimited growth of output buffers until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted, and the memory is unavailable.\n\nWhen password authentication is enabled on the Redis server but no password is provided, the client can still cause the output buffer to grow from \"NOAUTH\" responses until the system runs out of memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
          "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
          "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
          "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
          "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
          "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-21605"
        },
        {
          "category": "external",
          "summary": "RHBZ#2361883",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361883"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-21605",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-21605"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-21605",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21605"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/releases/tag/7.4.3",
          "url": "https://github.com/redis/redis/releases/tag/7.4.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff"
        }
      ],
      "release_date": "2025-04-23T15:38:11.042000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-09T12:40:33+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:8262"
        },
        {
          "category": "workaround",
          "details": "A workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in the following different ways:\n\n- Using network access control tools like firewalls, iptables, security groups, etc.\n- Enabling TLS and requiring users to authenticate using client side certificates.",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:53922db0add7e0958cbe2fed01100aaf9a981d8342b60b0d6262c882d4e0eb96_s390x",
            "8Base-Quay-3:quay/clair-rhel8@sha256:7b3d7f2909f149f5eada3e8aafd05ffd416cdbb97f34b9817d7a3de48ab9178c_amd64",
            "8Base-Quay-3:quay/clair-rhel8@sha256:ae3a3f0bee632fd731e839326e135310264f91904e9ee4c63c3cc04f6fbe0adb_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:738518079f920b22f9dce6e27ac9326dba3b1e25a9bdc37e518f8ca934e909cc_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:dc4aa6de488306e7975aaa8e8d577738b0f28825a6b4a2bfe42c48c5466b68d3_ppc64le",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:e53eb326bca3f35ffae78b3d4673aa43510d6ad9c1674548671b2121ab0483f1_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1f19aa829421eb29ecaa9dab21593ef07a8209a3647d704ec5b011300c097ad9_s390x",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:b594addbbbccee2193d4c9f66e4afb04b677e86ef96d69c59ff7d433af30e07b_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:cb2176bd24805de7eb712c56f19ee57134571fe69245e699985590ffc5efe601_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:0fc1e9800cc55f51700288b855e1856b1bb35a2e5dc4a9a8b305e7270aa75742_s390x",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:143350b6f8b14f22c192cfff16a57b965c39790f1e395a920b2e64346e3dee22_ppc64le",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:2db2dd98df0c68df7bd17621373583b3849d17698acb5befa8121a205f7b4a55_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:3385beb31aede68344611a4803d41268a9d180efb7cd659e596c328d9cfb1645_ppc64le",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:64fcf5f0de57d198a4081946cd4963969394b25945ab383dbd487e5ce5afbe88_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e1bd4e2c4f431d56ee3f9a6a9541dececfc93671f3e0ece7753aaf1ec680da93_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:51ec4956ad358e7da5dcd66ef3674818e1eaec88aeda5034af5747ac20a48f6b_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5f1c3962696735182a7d803dfbcc50530c0598e39a12157e5f7d71530210574c_s390x",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:d7d085b6324d4f61bf79f033ee1a01fd0dd8a469bccee71e8c663d9803c19267_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:382a7bfa46d01d60b73d1254e7723787a87b28452517a27f7c51da8c224dfa95_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:7502c7021919ced13d239dd688d1c1fe320e076f0486125ad0d8bca96eb20c2c_ppc64le",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:b6b02527a16046f1aca4b40db8a5d400bd72ee34a623f2bfd8f46543e89da0d2_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:13d37219c20374e35645c8e445dbee9f33db5405dcaed657393bc55018607230_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:2479b51cfe88cc8b421c71d01a5079783d04f73b357b0292f6d47430dd89ae60_s390x",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:83abe7a71af4f82d3b16e5ef37f723b29d731b501520fbfc2cadcbf30873e1cd_ppc64le",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:a77e67d57fe114ccb359d4794a6b04bc738d030719c76f76bafcb8092bd9d74b_s390x",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:c1a2394ee5d706ff6c2f0433bb12c89f673d7bc69186c8df067ecc0926d2ae6f_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:cbd2e872b20fc32de16f2dfd66ce3b01db284185360e4ecfdf992e8e2f0dab75_ppc64le",
            "8Base-Quay-3:quay/quay-rhel8@sha256:5fb1f7b31972545cb291d5ae1fb716f4a6cb538165e458b28e3831387d388291_s390x",
            "8Base-Quay-3:quay/quay-rhel8@sha256:61096dc4e8d8cbed0025445a514ceab197cd93f46a9bd7d380f496091cfbb0c3_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:fb2e90c6291f923290949d25b3f4db8b4bbb5118fc6cb2d412825db1b67d9176_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client"
    }
  ]
}

CVE-2024-21538 (GCVE-0-2024-21538)

Vulnerability from cvelistv5 – Published: 2024-11-08 05:00 – Updated: 2026-08-07 15:25

Summary

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1333 - Regular Expression Denial of Service (ReDoS)
CWE-1333 - Inefficient Regular Expression Complexity

Assigner

snyk

References

5 references

URL	Tags
https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-…
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJAR…
https://github.com/moxystudio/node-cross-spawn/pull/160
https://github.com/moxystudio/node-cross-spawn/co…
https://github.com/moxystudio/node-cross-spawn/co…

Impacted products

3 products

Vendor	Product	Version
n/a	cross-spawn	Affected: 0 , < 6.0.6 (semver) Affected: 7.0.0 , < 7.0.5 (semver)
n/a	org.webjars.npm:cross-spawn	Affected: 0 , < 6.0.6 (semver) Affected: 7.0.2 , < 7.0.6 (semver)
cross-spawn	cross-spawn	Affected: 0 , < 7.0.5 (custom) cpe:2.3:a:cross-spawn:cross-spawn::::::::

Credits

Rongchen Li

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cross-spawn:cross-spawn:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cross-spawn",
            "vendor": "cross-spawn",
            "versions": [
              {
                "lessThan": "7.0.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21538",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T14:54:27.777922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1333",
                "description": "CWE-1333 Inefficient Regular Expression Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-20T14:38:35.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cross-spawn",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "6.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.5",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "product": "org.webjars.npm:cross-spawn",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "6.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.6",
              "status": "affected",
              "version": "7.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Rongchen Li"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
            "version": "3.1"
          },
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Regular Expression Denial of Service (ReDoS)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T15:25:37.876Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "url": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"
        },
        {
          "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"
        },
        {
          "url": "https://github.com/moxystudio/node-cross-spawn/pull/160"
        },
        {
          "url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f"
        },
        {
          "url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2024-21538",
    "datePublished": "2024-11-08T05:00:04.695Z",
    "dateReserved": "2023-12-22T12:33:20.123Z",
    "dateUpdated": "2026-08-07T15:25:37.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21605 (GCVE-0-2025-21605)

Vulnerability from cvelistv5 – Published: 2025-04-23 15:38 – Updated: 2026-02-10 17:06

Title

Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

Summary

Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

6 references

URL	Tags
https://github.com/redis/redis/security/advisorie…	x_refsource_CONFIRM
https://github.com/redis/redis/releases/tag/7.4.3	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…
https://github.com/valkey-io/valkey/releases/tag/8.1.1
https://www.vicarius.io/vsociety/posts/cve-2025-2…
https://www.vicarius.io/vsociety/posts/cve-2025-2…

Impacted products

1 product

Vendor	Product	Version
redis	redis	Affected: >= 2.6, < 7.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-21605",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T16:11:06.562685Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:11:18.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-10T17:06:50.695Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00014.html"
          },
          {
            "url": "https://github.com/valkey-io/valkey/releases/tag/8.1.1"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-21605-detection-script-memory-exhaustion-vulnerability-in-redis-database"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-21605-mitigation-script-memory-exhaustion-vulnerability-in-redis-database"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.6, \u003c 7.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from \"NOAUTH\" responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-23T15:38:11.042Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff"
        },
        {
          "name": "https://github.com/redis/redis/releases/tag/7.4.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/releases/tag/7.4.3"
        }
      ],
      "source": {
        "advisory": "GHSA-r67f-p999-2gff",
        "discovery": "UNKNOWN"
      },
      "title": "Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-21605",
    "datePublished": "2025-04-23T15:38:11.042Z",
    "dateReserved": "2024-12-29T03:00:24.712Z",
    "dateUpdated": "2026-02-10T17:06:50.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4374 (GCVE-0-2025-4374)

Vulnerability from cvelistv5 – Published: 2025-05-06 14:49 – Updated: 2026-08-07 13:38

Title

Quay: incorrect privilege assignment

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-266 - Incorrect Privilege Assignment

Assigner

redhat

References

6 references

URL	Tags
https://access.redhat.com/errata/RHBA-2025:8262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHBA-2025:8263	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHBA-2025:8687	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHBA-2025:8688	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-4374	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2364267	issue-trackingx_refsource_REDHAT

Impacted products

16 products

Vendor	Product	Version
Project Quay	quay	Affected: 0 , < 3.11.11 (semver) Affected: 2.14.0 , < 3.14.2 (semver) Affected: 3.12.0 , < 3.12.10 (semver)
Red Hat	Red Hat Quay 3	Unaffected: v3.14.2-1 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.14.2-6 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.14.2-7 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.13.6-1 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.13.6-6 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.13.6-2 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.13.6-5 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.11.11-1 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.11.11-2 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.11.11-7 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.11.11-5 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.12.10-1 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.12.10-3 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.12.10-2 , < * (rpm) cpe:/a:redhat:quay:3::el8
Red Hat	Red Hat Quay 3	Unaffected: v3.12.10-4 , < * (rpm) cpe:/a:redhat:quay:3::el8

Date Public

2025-05-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-06T19:50:08.826161Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-06T19:50:23.456Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/quay/quay",
          "defaultStatus": "unaffected",
          "packageName": "quay",
          "product": "quay",
          "vendor": "Project Quay",
          "versions": [
            {
              "lessThan": "3.11.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.14.2",
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.12.10",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/clair-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-qemu-rhcos-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.14.2-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/clair-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-qemu-rhcos-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.13.6-5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/clair-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-qemu-rhcos-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.11.11-5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/clair-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-bridge-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-qemu-rhcos-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-container-security-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-bundle",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-operator-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:quay:3::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v3.12.10-3",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2025-05-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn\u0027t been mirrored yet, they are granted \"Admin\" permissions on the newly created repository."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T13:38:41.158Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHBA-2025:8262",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2025:8262"
        },
        {
          "name": "RHBA-2025:8263",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2025:8263"
        },
        {
          "name": "RHBA-2025:8687",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2025:8687"
        },
        {
          "name": "RHBA-2025:8688",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2025:8688"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-4374"
        },
        {
          "name": "RHBZ#2364267",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364267"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-06T01:20:45.731Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-05-06T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Quay: incorrect privilege assignment",
      "workarounds": [
        {
          "lang": "en",
          "value": "Permissions can be updated after creation but there\u0027s no preventative measure before hand."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-266: Incorrect Privilege Assignment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-4374",
    "datePublished": "2025-05-06T14:49:28.660Z",
    "dateReserved": "2025-05-06T01:24:21.315Z",
    "dateUpdated": "2026-08-07T13:38:41.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHBA-2025:8262

CVE-2024-21538 (GCVE-0-2024-21538)

CVE-2025-21605 (GCVE-0-2025-21605)

CVE-2025-4374 (GCVE-0-2025-4374)

Tags

Sightings

Nomenclature