Security fixes in harbor-registry-fips 2.7.1-r0 (CVE-2025-29923)
Affects harbor-registry-fipsSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · patch available : update harbor-registry-fips when convenient.
Data as of 10/25/2026, 04:40:10 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| harbor-registry-fips | Affected
| Fixed in
|
AI-suggested
A fix is available in go-redis versions 9.5.5, 9.6.3, and 9.7.2; however, since 9.7.2 has been yanked, version 9.7.3 is the lowest available patched version on the 9.7.x branch. Users should upgrade to these fixed versions. As a workaround, set the DisableIdentity flag to true when constructing the client instance to prevent the issue. No other mitigation steps are indicated.
Description
Package harbor-registry-fips version 2.7.1-r0 fixes 3 vulnerabilities: CVE-2025-29923, CVE-2025-61727, CVE-2025-61729
Impact
This vulnerability can cause the go-redis client to receive out-of-order or incorrect responses from the Redis server under certain network conditions and client configurations. This may lead to incorrect command results being processed by applications using affected versions of go-redis. The impact is limited to integrity (incorrect responses) without confidentiality or availability effects. The CVSS score is 3.7 (low severity). There are no known exploits in the wild.
Summary
The go-redis client library for Go versions prior to 9.5.5, 9.6.3, and 9.7.2 has an improper input validation issue (CWE-20) that can cause out-of-order responses when the CLIENT SETINFO command times out during connection establishment. This occurs if the client is configured to send its identity and experiences network connectivity problems or aggressive timeouts. For sticky connections, this results in persistent out-of-order responses for the connection's lifetime, and all pipelined commands receive incorrect responses. When using the default connection pool, at most one out-of-order response occurs before the connection is discarded. The vulnerability is addressed in versions 9.5.5, 9.6.3, and 9.7.2 (with 9.7.3 as the lowest available patched 9.7.x version). A recommended workaround is to disable client identity transmission by setting DisableIdentity to true during client construction.
Weaknesses
- CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
References
- msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-29923.json (opens in a new tab)
- support.microsoft.com/lifecycle (opens in a new tab)
- first.org/cvss (opens in a new tab)
- github.com/redis/go-redis/security/advisories/GHSA-92cp-5422-2mw7 (opens in a new tab)
- github.com/redis/go-redis/pull/3295 (opens in a new tab)
- github.com/redis/go-redis/commit/d236865b0cfa1b752ea4b7da666b1fdcd0acebb6 (opens in a new tab)
- github.com/distribution/distribution (opens in a new tab)