RHSA-2025:4810 - Security Advisory

Topic

Submariner 0.18 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.11.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Description

Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud.

For more information about Submariner, see the Submariner open source community website at: https://submariner.io/.

This advisory contains bug fixes and enhancements to the Submariner container images.

Security fix(es):

• quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (CVE-2024-53259)
• golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)
• crypto/internal/nistec: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)
• golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (CVE-2025-22868)
• golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

Solution

To learn more about Submariner, see https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/networking/networking#submariner.

Affected Products

• Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 9 x86_64

Fixes

• BZ - 2329991 - CVE-2024-53259 quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
• BZ - 2341751 - CVE-2024-45336 golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect
• BZ - 2344219 - CVE-2025-22866 crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
• BZ - 2348366 - CVE-2025-22868 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
• BZ - 2354195 - CVE-2025-30204 golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

CVEs

• CVE-2019-12900
• CVE-2020-11023
• CVE-2021-41043
• CVE-2021-43618
• CVE-2022-48468
• CVE-2022-48554
• CVE-2023-7104
• CVE-2023-29491
• CVE-2023-37920
• CVE-2024-2236
• CVE-2024-3596
• CVE-2024-8176
• CVE-2024-8508
• CVE-2024-9287
• CVE-2024-10963
• CVE-2024-11168
• CVE-2024-11187
• CVE-2024-12797
• CVE-2024-24806
• CVE-2024-28834
• CVE-2024-28835
• CVE-2024-34397
• CVE-2024-45336
• CVE-2024-53259
• CVE-2024-53580
• CVE-2024-56171
• CVE-2025-0395
• CVE-2025-22866
• CVE-2025-22868
• CVE-2025-24928
• CVE-2025-30204

References

• https://access.redhat.com/security/updates/classification/#important