Threats Tagged 'cve-2025-13033'

The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1. This release updates to the latest version.

Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.

CVE-2025-13033 is a high-severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 caused by improper handling of specially formatted recipient email addresses in its email parsing library. An attacker can craft a recipient address embedding an external address within quotes, causing the system to misdirect sensitive emails to the attacker instead of the intended internal recipient. This flaw enables data leakage of sensitive information without requiring authentication or user interaction. The vulnerability has a CVSS score of 7.5, reflecting its network exploitability and high confidentiality impact. No known exploits are currently reported in the wild. European organizations using this Red Hat product, especially those managing Kubernetes clusters with integrated email notifications, face risks of confidential data exposure. Mitigation involves applying vendor patches once available, auditing email handling configurations, and implementing strict email validation and monitoring for anomalous outbound emails. Countries with significant Red Hat and Kubernetes adoption, such as Germany, France, and the UK, are most likely affected. Defenders should prioritize patching and monitoring to prevent unauthorized data exfiltration via email misdirection.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-13033