This advisory addresses two security vulnerabilities in the osp-director-operator-container component of Red Hat OpenStack Platform 16.2 (Train). The first vulnerability (CVE-2025-21613) involves argument injection through the URL field in the go-git client, potentially allowing unintended command execution or manipulation. The second vulnerability (CVE-2025-21614) allows denial-of-service (DoS) attacks via maliciously crafted Git server replies targeting go-git clients. Both issues have been rated as important by Red Hat Product Security. The advisory references fixes for these vulnerabilities and provides guidance on applying the update.

The vulnerabilities could allow an attacker to inject arguments via the URL field, potentially leading to unintended behavior or exploitation within the go-git client used by the osp-director-operator. Additionally, the denial-of-service vulnerability could disrupt service by causing the go-git client to fail or crash when processing malicious Git server responses. These issues affect the stability and security of the affected Red Hat OpenStack Platform component.

Red Hat has released an update for the osp-director-operator-container in Red Hat OpenStack Platform 16.2 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official Red Hat security advisory with an available update, applying the vendor-provided fix is the recommended mitigation.