This advisory covers two security vulnerabilities in the go-git library used by Grafana in Red Hat Enterprise Linux 9.4 EUS. CVE-2025-21613 is an argument injection vulnerability via the URL field, categorized under CWE-88 (Argument Injection or Modification). CVE-2025-21614 is a denial of service vulnerability caused by maliciously crafted Git server replies, related to CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has provided updated Grafana packages that include fixes for these issues. The advisory is rated as Important by Red Hat Product Security.

Successful exploitation of CVE-2025-21613 could allow an attacker to inject arguments via the URL field, potentially leading to unintended command execution or manipulation within the go-git client context. CVE-2025-21614 could enable an attacker to cause a denial of service by sending crafted Git server replies that disrupt the go-git client operation. These vulnerabilities affect Grafana installations on Red Hat Enterprise Linux 9.4 and could impact availability and integrity of the affected systems.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the available security updates as detailed in the Red Hat advisory RHSA-2025:0662 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.