Red Hat Ceph Storage, a scalable software-defined storage platform, has updated container images based on versions 7.1 and 8.1 of Red Hat Ceph Storage combined with Red Hat Enterprise Linux 8.10, 9.4, 9.5, and later. These updates address multiple security vulnerabilities including CVE-2024-24557 (moby classic builder cache poisoning), CVE-2024-45338 (non-linear parsing in golang.org/x/net/html), CVE-2024-53382 (DOM clobbering in prismjs), CVE-2025-22865 (panic in crypto/x509), CVE-2025-22868 (memory consumption in golang.org/x/oauth2/jws), CVE-2025-22871 (HTTP request smuggling in net/http), and CVE-2025-30204 (excessive memory allocation in golang-jwt/jwt). The vendor advisory strongly recommends users pull the updated container images from the Red Hat Ecosystem Catalog to apply these fixes. The advisories also provide references to release notes and instructions for applying updates.

The vulnerabilities fixed in these updates include cache poisoning, code execution risks, parsing errors leading to potential crashes or memory issues, DOM clobbering, and HTTP request smuggling. These issues could potentially allow attackers to execute arbitrary code, cause denial of service, or manipulate data within the affected container environments. The impact is significant enough for Red Hat to classify the advisory as important and the severity as high.

Red Hat has released updated container images for Red Hat Ceph Storage 7.1 and 8.1 that include fixes for the listed vulnerabilities. Users should pull the updated container images from the Red Hat Ecosystem Catalog as the primary remediation step. Before applying these updates, users should ensure all previously released errata relevant to their systems have been applied. Detailed update instructions and supported configurations are available in the Red Hat knowledge base articles linked in the advisory. No additional mitigation steps are indicated beyond applying these updated container images.