This advisory covers two vulnerabilities in the osp-director-operator-container component of Red Hat OpenStack Platform 16.2. CVE-2025-21613 involves argument injection via the URL field in the go-git library, potentially allowing unintended command or argument execution. CVE-2025-21614 concerns a denial of service vulnerability caused by maliciously crafted Git server replies affecting go-git clients. Red Hat has issued an important security update to address these issues, which are rated with high severity. The update is available for Red Hat OpenStack Platform 16.2 (Train) on x86_64 architectures. No CVSS base score is provided in the advisory.

The vulnerabilities could allow attackers to perform argument injection attacks or cause denial of service conditions in the affected go-git clients used by the osp-director-operator-container. This may impact the stability and security of Red Hat OpenStack Platform 16.2 deployments using this component. However, there are no known exploits in the wild currently reported. The overall security impact is rated as Important by Red Hat Product Security, indicating a significant risk if unpatched.

Red Hat has released an official security update for the osp-director-operator-container component in Red Hat OpenStack Platform 16.2. Users should apply the update as described in the Red Hat advisory article https://access.redhat.com/articles/11258 to remediate these vulnerabilities. Since this is an on-premises product, administrators must manually deploy the update. No additional mitigation steps are indicated or required beyond applying the official update.