csaf_redhat - rhsa-2025:3709

rhsa-2025:3709

Vulnerability from csaf_redhat

Published

2025-04-08 17:51

Modified

2025-07-23 20:49

Summary

Red Hat Security Advisory: updated discovery container images

Notes

Topic

Updated container images are now available for Discovery 1.13.1.

Details

The Discovery container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References). This release resolves the following CVEs: * discovery-server-container: HTTP Request Smuggling in benoitc/gunicorn (CVE-2025-26699) * discovery-server-container: Potential denial-of-service vulnerability in django.utils.text.wrap() (CVE-2024-6827) Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated container images are now available for Discovery 1.13.1.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Discovery container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nThis release resolves the following CVEs:\n\n* discovery-server-container: HTTP Request Smuggling in benoitc/gunicorn (CVE-2025-26699)\n* discovery-server-container: Potential denial-of-service vulnerability in django.utils.text.wrap() (CVE-2024-6827)\n\nDockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:3709",
        "url": "https://access.redhat.com/errata/RHSA-2025:3709"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "DISCOVERY-924",
        "url": "https://issues.redhat.com/browse/DISCOVERY-924"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3709.json"
      }
    ],
    "title": "Red Hat Security Advisory: updated discovery container images",
    "tracking": {
      "current_release_date": "2025-07-23T20:49:24+00:00",
      "generator": {
        "date": "2025-07-23T20:49:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.4"
        }
      },
      "id": "RHSA-2025:3709",
      "initial_release_date": "2025-04-08T17:51:49+00:00",
      "revision_history": [
        {
          "date": "2025-04-08T17:51:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-04-08T17:51:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-23T20:49:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Discovery 1 for RHEL 9",
                "product": {
                  "name": "Discovery 1 for RHEL 9",
                  "product_id": "9Base-discovery-1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:discovery:1.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Discovery"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
                "product": {
                  "name": "discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
                  "product_id": "discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1.13.1-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64",
                "product": {
                  "name": "discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64",
                  "product_id": "discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1.13.1-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64 as a component of Discovery 1 for RHEL 9",
          "product_id": "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64"
        },
        "product_reference": "discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
        "relates_to_product_reference": "9Base-discovery-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64 as a component of Discovery 1 for RHEL 9",
          "product_id": "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
        },
        "product_reference": "discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64",
        "relates_to_product_reference": "9Base-discovery-1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-6827",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2025-03-20T11:07:09.471036+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2353700"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Gunicorn. This vulnerability allows request smuggling, leading to cache poisoning, data exposure, session manipulation, Server-side request forgery (SSRF), Cross-site scripting (XSS), denial of service (DoS), data integrity compromise, security bypass, and information leakage via improper validation of the \u0027Transfer-Encoding\u0027 header.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gunicorn: HTTP Request Smuggling in benoitc/gunicorn",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
          "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-6827"
        },
        {
          "category": "external",
          "summary": "RHBZ#2353700",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2353700"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-6827",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-6827"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-6827",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6827"
        },
        {
          "category": "external",
          "summary": "https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7",
          "url": "https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7"
        }
      ],
      "release_date": "2025-03-20T10:09:55.725000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-04-08T17:51:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:3709"
        },
        {
          "category": "workaround",
          "details": "Red Hat Product Security currently does not have a recommended mitigation at this time.",
          "product_ids": [
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "gunicorn: HTTP Request Smuggling in benoitc/gunicorn"
    },
    {
      "cve": "CVE-2025-26699",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-02-28T09:37:31.651000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2348993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A potential denial of service vulnerability exists in django.utils.text.wrap() and the wordwrap template filter. When processing extremely long strings, these functions may cause excessive resource consumption, potentially leading to service disruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "django: Potential denial-of-service vulnerability in django.utils.text.wrap()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as a Moderate severity because it exposes the wrap() method and wordwrap template filter to a potential denial of service attack. Malicious input containing extremely long strings could cause excessive processing, leading to resource exhaustion. However, it does not affect data confidentiality or integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
          "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-26699"
        },
        {
          "category": "external",
          "summary": "RHBZ#2348993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-26699",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-26699"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-26699",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26699"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-p3fp-8748-vqfq",
          "url": "https://github.com/advisories/GHSA-p3fp-8748-vqfq"
        }
      ],
      "release_date": "2025-03-06T14:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-04-08T17:51:49+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:3709"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:bc8019b85528333553abb25efa98a3f7c983de4eb93c890ce88232cee2297c8d_amd64",
            "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:eac30bac86efad29e5ad517261e35ec7561e5130abd1059ab20499bd5fd7214b_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "django: Potential denial-of-service vulnerability in django.utils.text.wrap()"
    }
  ]
}

CVE-2025-26699 (GCVE-0-2025-26699)

Vulnerability from cvelistv5

Published

2025-03-06 00:00

Modified

2025-03-19 20:03

Severity ?

5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

References

►

URL

	Vendor	Product	Version
	djangoproject	Django	Version: 4.2 < 4.2.20 Version: 5.0 < 5.0.13 Version: 5.1 < 5.1.7

CVE-2024-6827 (GCVE-0-2024-6827)

Vulnerability from cvelistv5

Published

2025-03-20 10:09

Modified

2025-03-20 18:32

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests

Summary

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.

References

►

URL

	Vendor	Product	Version
	benoitc	benoitc/gunicorn	Version: unspecified <

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2025:3709

Vulnerability from csaf_redhat

CVE-2025-26699 (GCVE-0-2025-26699)

Vulnerability from cvelistv5

CVE-2024-6827 (GCVE-0-2024-6827)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature