Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT
CVE: CVE-2025-24976
Component: distribution
CWE: CWE-639
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-02-11T15:48:59.700000+00:00

A flaw was found in Distribution. Certain versions with token authentication enabled may be vulnerable to an issue where token authentication allows an attacker to inject an untrusted signing key in a JSON web token (JWT). The issue is due to how the JSON web key (JWK) verification is performed. When a JWT contains a JWK header without a certificate chain, the code only checks if the KeyID (`kid`) matches one of the trusted keys but doesn't verify that the key material matches.


Remediation:
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:fc702dee694fbf3179ecff9b933a6baea6579b291eea13523330954972c126ef

      (For s390x architecture)
      The image digest is sha256:7f94e4013e9c59e5befb398bca532b588cf30caca9b4054f49d5228e177ad3a3

      (For ppc64le architecture)
      The image digest is sha256:6045c45bc63610506c33a3f7dda7b14a18dce2abc5a652644b6f2484c8d4ce65

      (For aarch64 architecture)
      The image digest is sha256:50d7ad83896c396a0063fca186632efe8694a887f4b4ab301cec9aeb1732f324

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.18/release_notes/ocp-4-18-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:61dffd292f6689a3381dd05f7845dcd5d27c099fce2f460aa03d760d535f81e6

      (For s390x architecture)
      The image digest is sha256:eb491d073925d635cbfe0d56d2474ef5ad25301da175648a7d577ed4cd4243c1

      (For ppc64le architecture)
      The image digest is sha256:5df510f9d63ec31215a16cf0e08b0d9834d51c700666814cd3b6cb66b5572833

      (For aarch64 architecture)
      The image digest is sha256:218776c1c290da3bffb333d81ea34fb287fc8549df204fcb49eabcfc92c38f0b

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.18/updating/updating_a_cluster/updating-cluster-cli.html