RHSA-2025:22936 - Security Advisory

Topic

Kiali 1.73.25 for Red Hat OpenShift Service Mesh 2.6

Description

Kiali 1.73.25, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently

Security Fix(es):

• kiali-ossmc-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031)
• kiali-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031)
• kiali-ossmc-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)
• kiali-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)

Solution

See Kiali 1.73.25 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x

Fixes

CVEs

• CVE-2025-64756
• CVE-2025-66031
• CVE-2025-64756
• CVE-2025-66031

References

• https://access.redhat.com/security/updates/classification
• https://access.redhat.com/security/updates/classification/