Bug 2354195 (CVE-2025-30204)
| Summary: | CVE-2025-30204 golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, adudiak, agarcial, akostadi, alcohan, amasferr, amctagga, anjoseph, aoconnor, asegurap, bdettelb, bniver, brking, caswilli, cbartlet, ckandaga, cmah, crizzo, dahernan, dbosanac, dfreiber, dhanak, dmayorov, doconnor, drosa, drow, dsimansk, dymurray, eaguilar, ebaron, eglynn, fdeutsch, flucifre, gkamathe, gmeno, gparvin, haoli, hkataria, ibolton, jaharrin, jajackso, jburrell, jcammara, jcantril, jdobes, jeder, jforrest, jjoyce, jkoehler, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jolong, jprabhak, jreimann, jschluet, jtanner, jwendell, jwong, kaycoth, kegrant, kingland, koliveir, kshier, kverlaen, lball, lchilton, lgamliel, lhh, ljawale, lphiri, lsvaty, luizcosta, mabashia, manissin, matzew, mbenjamin, mburns, mdessi, mgarciac, mhackett, mkleinhe, mmakovy, mnovotny, mrizzi, mwringe, ngough, njean, nobody, nweather, oezr, omaciel, orabin, oramraz, owatkins, pahickey, pbraun, pcattana, periklis, pgaikwad, pgrist, pierdipi, pjindal, pvasanth, rbobbitt, rcernich, rfreiman, rhaigner, rhuss, rjohnson, rojacob, sausingh, sdawley, sfeifer, sfroberg, shvarugh, simaishi, slucidi, smcdonal, smullick, sostapov, sseago, stcannon, stirabos, teagle, tfister, thason, thavo, tjochec, vereddy, veshanka, vkumar, whayutin, wtam, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2354392, 2354393, 2354394, 2354395, 2354397, 2354398, 2354399, 2354416, 2354417, 2354418, 2354419, 2354420, 2354421, 2354423, 2354428, 2354431, 2354432, 2354434, 2354435, 2354441, 2354442, 2354389, 2354390, 2354391, 2354396, 2354400, 2354401, 2354402, 2354403, 2354404, 2354405, 2354406, 2354407, 2354408, 2354409, 2354410, 2354411, 2354412, 2354413, 2354414, 2354415, 2354422, 2354424, 2354425, 2354426, 2354427, 2354429, 2354430, 2354433, 2354438, 2354439, 2354440, 2354443, 2354445, 2354447 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-03-21 22:01:06 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:3344 https://access.redhat.com/errata/RHSA-2025:3344 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:3411 https://access.redhat.com/errata/RHSA-2025:3411 This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2025:3503 https://access.redhat.com/errata/RHSA-2025:3503 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:3616 https://access.redhat.com/errata/RHSA-2025:3616 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:3618 https://access.redhat.com/errata/RHSA-2025:3618 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:3698 https://access.redhat.com/errata/RHSA-2025:3698 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:3565 https://access.redhat.com/errata/RHSA-2025:3565 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:3569 https://access.redhat.com/errata/RHSA-2025:3569 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:3577 https://access.redhat.com/errata/RHSA-2025:3577 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.5 Via RHSA-2025:3928 https://access.redhat.com/errata/RHSA-2025:3928 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.6 Via RHSA-2025:3929 https://access.redhat.com/errata/RHSA-2025:3929 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.7 Via RHSA-2025:3930 https://access.redhat.com/errata/RHSA-2025:3930 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:3775 https://access.redhat.com/errata/RHSA-2025:3775 This issue has been addressed in the following products: RHOL-5.9-RHEL-9 Via RHSA-2025:3906 https://access.redhat.com/errata/RHSA-2025:3906 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:3798 https://access.redhat.com/errata/RHSA-2025:3798 This issue has been addressed in the following products: RHOL-6.1-RHEL-9 Via RHSA-2025:3907 https://access.redhat.com/errata/RHSA-2025:3907 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2025:3790 https://access.redhat.com/errata/RHSA-2025:3790 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:4019 https://access.redhat.com/errata/RHSA-2025:4019 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:4008 https://access.redhat.com/errata/RHSA-2025:4008 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:4012 https://access.redhat.com/errata/RHSA-2025:4012 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 Via RHSA-2025:4250 https://access.redhat.com/errata/RHSA-2025:4250 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:4204 https://access.redhat.com/errata/RHSA-2025:4204 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:4177 https://access.redhat.com/errata/RHSA-2025:4177 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:4211 https://access.redhat.com/errata/RHSA-2025:4211 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:4462 https://access.redhat.com/errata/RHSA-2025:4462 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster engine for Kubernetes 2.5 for RHEL 8 Via RHSA-2025:4473 https://access.redhat.com/errata/RHSA-2025:4473 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 Via RHSA-2025:4502 https://access.redhat.com/errata/RHSA-2025:4502 This issue has been addressed in the following products: RHODF-4.18-RHEL-9 Via RHSA-2025:4511 https://access.redhat.com/errata/RHSA-2025:4511 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:4569 https://access.redhat.com/errata/RHSA-2025:4569 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:4669 https://access.redhat.com/errata/RHSA-2025:4669 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2025:4409 https://access.redhat.com/errata/RHSA-2025:4409 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2025:4422 https://access.redhat.com/errata/RHSA-2025:4422 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 Via RHSA-2025:4810 https://access.redhat.com/errata/RHSA-2025:4810 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7404 https://access.redhat.com/errata/RHSA-2025:7404 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7407 https://access.redhat.com/errata/RHSA-2025:7407 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7425 https://access.redhat.com/errata/RHSA-2025:7425 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:7475 https://access.redhat.com/errata/RHSA-2025:7475 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:7479 https://access.redhat.com/errata/RHSA-2025:7479 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:7503 https://access.redhat.com/errata/RHSA-2025:7503 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2025:4677 https://access.redhat.com/errata/RHSA-2025:4677 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:7967 https://access.redhat.com/errata/RHSA-2025:7967 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:7702 https://access.redhat.com/errata/RHSA-2025:7702 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2025:8075 https://access.redhat.com/errata/RHSA-2025:8075 This issue has been addressed in the following products: Red Hat OpenShift Dev Spaces 3 Containers Via RHSA-2025:8244 https://access.redhat.com/errata/RHSA-2025:8244 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:8267 https://access.redhat.com/errata/RHSA-2025:8267 This issue has been addressed in the following products: multicluster-globalhub 1.4 for RHEL 9 Via RHSA-2025:8384 https://access.redhat.com/errata/RHSA-2025:8384 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.4 for RHEL 8 Via RHSA-2025:8390 https://access.redhat.com/errata/RHSA-2025:8390 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 Via RHSA-2025:8392 https://access.redhat.com/errata/RHSA-2025:8392 This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2025:8479 https://access.redhat.com/errata/RHSA-2025:8479 This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.8 Via RHSA-2025:8510 https://access.redhat.com/errata/RHSA-2025:8510 This issue has been addressed in the following products: RHODF-4.15-RHEL-9 Via RHSA-2025:8544 https://access.redhat.com/errata/RHSA-2025:8544 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 Via RHSA-2025:8542 https://access.redhat.com/errata/RHSA-2025:8542 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 Via RHSA-2025:8691 https://access.redhat.com/errata/RHSA-2025:8691 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:8560 https://access.redhat.com/errata/RHSA-2025:8560 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:8552 https://access.redhat.com/errata/RHSA-2025:8552 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:8556 https://access.redhat.com/errata/RHSA-2025:8556 This issue has been addressed in the following products: multicluster-globalhub 1.2 for RHEL 9 Via RHSA-2025:9388 https://access.redhat.com/errata/RHSA-2025:9388 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 Via RHSA-2025:9541 https://access.redhat.com/errata/RHSA-2025:9541 This issue has been addressed in the following products: OADP-1.3-RHEL-9 Via RHSA-2025:9646 https://access.redhat.com/errata/RHSA-2025:9646 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2025:9259 https://access.redhat.com/errata/RHSA-2025:9259 This issue has been addressed in the following products: OADP-1.4-RHEL-9 Via RHSA-2025:11396 https://access.redhat.com/errata/RHSA-2025:11396 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster engine for Kubernetes 2.7 for RHEL 8 Via RHSA-2025:11573 https://access.redhat.com/errata/RHSA-2025:11573 This issue has been addressed in the following products: Red Hat Ceph Storage 8.1 Via RHSA-2025:11749 https://access.redhat.com/errata/RHSA-2025:11749 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:11669 https://access.redhat.com/errata/RHSA-2025:11669 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster engine for Kubernetes 2.6 for RHEL 8 Via RHSA-2025:13900 https://access.redhat.com/errata/RHSA-2025:13900 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.8 for RHEL 9 multicluster engine for Kubernetes 2.8 for RHEL 8 Via RHSA-2025:16101 https://access.redhat.com/errata/RHSA-2025:16101 |