RHSA-2025:22937 - Security Advisory

Topic

Kiali 2.4.11 for Red Hat OpenShift Service Mesh 3.0

Description

Kiali 2.4.11, for Red Hat OpenShift Service Mesh 3.0, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently

Security Fix(es):

• kiali-ossmc-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031)
• kiali-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031)
• kiali-ossmc-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)
• kiali-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)

Solution

See Kiali 2.4.11 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat

Fixes

CVEs

• CVE-2025-64756
• CVE-2025-66031
• CVE-2025-64756
• CVE-2025-66031

References

• https://access.redhat.com/security/updates/classification
• https://access.redhat.com/security/updates/classification/