Threats Tagged 'cve-2025-49146'

Multiple security vulnerabilities affect the consul-k8s-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.59. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2025:21331 Security Fix(es): * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133) * runc: container escape with malicious config due to /dev/console mount and related races (CVE-2025-52565) * runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.

AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.12.5 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * (CVE-2025-48734) commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default * (CVE-2025-49146) postgresql: pgjdbc insecure authentication in channel binding For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat has released an important security update for the Red Hat build of Quarkus version 3.20.2 addressing two vulnerabilities: CVE-2025-49146, involving insecure authentication in pgjdbc channel binding, and CVE-2025-49574, a potential data leak in Quarkus. These issues have been fixed in this release. Users should apply this update after ensuring all previous errata are installed.

Red Hat has released an important security update for its build of Quarkus version 3.15.6 addressing two vulnerabilities: CVE-2025-49146, involving insecure authentication in PostgreSQL JDBC channel binding, and CVE-2025-49574, related to a potential data leak in Quarkus. These issues are fixed in the 3.15.6 release. The update is rated as important by Red Hat Product Security. Users should apply this update after ensuring all prior errata are installed.

AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.13.1 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * (CVE-2025-1948) jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability * (CVE-2025-48734) commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default * (CVE-2025-49146) postgresql: pgjdbc insecure authentication in channel binding For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat build of Apache Camel 4.10.3 for Spring Boot patch release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Security Fix(es): * jetty-server: Jetty: Gzip Request Body Buffer Corruption (CVE-2024-13009) * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734) * postgresql: pgjdbc insecure authentication in channel binding (CVE-2025-49146)