RHSA-2025:23546 - Security Advisory

Topic

Red Hat Quay 3.16.0 is now available with bug fixes.

Description

Quay 3.16.0

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Fixes

• PROJQUAY-9732 - [3.16] Cannot use proxy cache for ghcr.io
• PROJQUAY-9590 - new ui: Add DISABLE_ANGULAR_UI param
• PROJQUAY-9579 - Quay new UI should support display the Cosign Icon when the image tag has been signed via Cosign
• PROJQUAY-9525 - Quay new UI can't display the customized "Registry Title" on the name of Browser Tab
• PROJQUAY-9461 - [Pre-merge]: Quay new UI login page can't show the customized "REGISTRY_TITLE"
• PROJQUAY-9272 - New UI: Regex search drop down not working
• PROJQUAY-8584 - Customizable StorageClass in OpenShift Deployments
• PROJQUAY-7538 - Issue with Email Notifications for Repository Names Containing Slashes ("/") in Quay
• PROJQUAY-9331 - [New UI] "Use regular expressions" doesn't appear when clicking the drop down button
• PROJQUAY-9281 - Enable PKCE integration with OIDC
• PROJQUAY-9269 - New UI: manifest layers
• PROJQUAY-9209 - New UI: User account settings
• PROJQUAY-8560 - Disallow pushes of manifests with negative layer sizes
• PROJQUAY-8414 - Image pull activity tracking
• PROJQUAY-8086 - Registry calculation not working if SUPER_USERS empty but LDAP_SUPERUSER_FILTER specified
• PROJQUAY-7038 - [New UI] When switch UI theme, "Use regular expressions" doesn't appear with clicking the drop down button
• PROJQUAY-6522 - Quay new UI should refresh the Organizations page automatically after create new organization
• PROJQUAY-6106 - OpenSSL 3 breaks Quay
• PROJQUAY-4141 - Customize StorageClass for PVCs

CVEs

• CVE-2024-34156
• CVE-2025-47913
• CVE-2025-58183
• CVE-2025-58754

References

• https://access.redhat.com/security/updates/classification/