RHSA-2025:9541 - Security Advisory

标题

Submariner 0.17.6 packages fix bugs and adds enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.10.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE links in the References section.

描述

Submariner 0.17.6 enables direct networking between pods and services on different Kubernetes clusters that are on-premises or in the cloud.

This advisory contains bug fixes and enhancements to the Submariner container images.

Security fixes:

• golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868)
• golang-jwt/jwt: jwt-go allows excessive memory allocation during header

parsing (CVE-2025-30204)

解决方案

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

受影响的产品

• Red Hat Advanced Cluster Management for Kubernetes 2 for RHEL 9 x86_64

修复

• BZ - 2348366 - CVE-2025-22868 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
• BZ - 2354195 - CVE-2025-30204 golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

CVE

• CVE-2020-11023
• CVE-2023-2953
• CVE-2024-2236
• CVE-2024-11187
• CVE-2024-50602
• CVE-2024-56171
• CVE-2025-0395
• CVE-2025-22868
• CVE-2025-24928
• CVE-2025-30204

参考

• https://access.redhat.com/security/updates/classification/#important