Go JOSE's Parsing Vulnerable to Denial of Service
CVE: CVE-2025-27144
Component: go-jose
CWE: CWE-770
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-24T22:22:22.863000+00:00

A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
If you are using an earlier version of RHACS 4.6, you are advised to upgrade to this patch release 4.6.4.
If you are using an earlier version of RHACS 4.7, you are advised to upgrade to patch release 4.7.1.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/ocp-4-14-release-notes

For Red Hat OpenShift Logging 5.9, see the following instructions to apply this update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/logging/cluster-logging-upgrading
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

For Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.16/observability/logging/logging-6.0/log6x-upgrading-to-6.html
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

For Red Hat OpenShift Logging 6.1, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.17/observability/logging/logging-6.1/log6x-upgrading-to-6.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:6da09834a9e0e30a79f77c13c2520a25172d8be3fc044dc2ad1392d69b2edfbf

      (For s390x architecture)
      The image digest is sha256:bcd96f1db1a6dcf6f7185d5410d9d665fb72545b1094c5d4e5696e08c10e0adf

      (For ppc64le architecture)
      The image digest is sha256:30f50074efde956337703e02c05a8a47854a669745178684ab9e18ca38173278

      (For aarch64 architecture)
      The image digest is sha256:0b83c98681f690f8c45c0f13002c251b925023da9416bf3106f9e9aeeec810ef

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:11be35de1e402b34a4fcbefcb8497f8c4d75d5c5269bcfc0781ccda7416e89b7

      (For s390x architecture)
      The image digest is sha256:4b96f6ab4fb66b0f2fe9a32611916d73e13ad0cefc88266052bcbbc756e8292a

      (For ppc64le architecture)
      The image digest is sha256:07383dce69acbb68a18b2a4bdbaf0e27365d2bb82fe7b71d4a3fa11af922dc45

      (For aarch64 architecture)
      The image digest is sha256:d1c86951a2ea1084c6da2e8bac72943d689e631114e5dfdc821f55d0a01c24a1

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:9efd67719b76a75def13a0e08125a361553c8b06691b39bdeff4994c4e907d44

      (For s390x architecture)
      The image digest is sha256:d48074dde460f4e6dd8aa20d3a4bc6afcc3d5e61c2b44bf9b019fc6b2bcb43f7

      (For ppc64le architecture)
      The image digest is sha256:854836a1c1abbc3009190b2c3b26cce91acecf375ea75f4af49faf341514ca72

      (For aarch64 architecture)
      The image digest is sha256:c70fca1f2136dac3a06b6fedaf563ea332f368e27590dad481a82a93a41e01a5

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:31e8978d1f7a24c3e70dcc12c93dd5e73311b78e528f73beb020ddbe3270e07d

      (For s390x architecture)
      The image digest is sha256:7e6a77a66b2f93afb2108ada0617d26dceadb130b58a5d3070142a7f6aca4ade

      (For ppc64le architecture)
      The image digest is sha256:af37b07cf408da430bab837ba8a0083934fa99df14efd7855240b77d9e102f0e

      (For aarch64 architecture)
      The image digest is sha256:e5d7b0851e8cd4378bc810b2fd1f19489836ea186a6678eed1add4bed4f08b13

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:720f89718effd16de7d77e5533c9608f1845295a2e00dfff543d0cf9aa09b2a0

      (For s390x architecture)
      The image digest is sha256:d82ec502516460379739026329cb4a5231f8d27edbba8f23dff4d8ccff9b18f3

      (For ppc64le architecture)
      The image digest is sha256:9006d776ad56184e1c486e470c9c486c0f5ade36835f4e20708c40b1a64c5929

      (For aarch64 architecture)
      The image digest is sha256:c5991a00282e25fb0fb1fdf44ccc3c7a2a88d24015212cc8770b418422dc71c0

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:61fdad894f035a8b192647c224faf565279518255bdbf60a91db4ee0479adaa6

      (For s390x architecture)
      The image digest is sha256:d23d9606b041cab5a558d7256d1e942ec46e8a95b1d2e78a1639745b51a1935f

      (For ppc64le architecture)
      The image digest is sha256:ac80b3f4836157b3a240180b52df9b4796bfc16b4e869ef03d8901de21b6dba0

      (For aarch64 architecture)
      The image digest is sha256:d1dc7362306233369356bdcbe365e3e39e494f65bfe1c805c9c41eafa43c143a

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:b3c76706606940d84964095aaab1a8ed4eca0d1bd6833b4eb718115842ef6850

      (For s390x architecture)
      The image digest is sha256:ba245bfdba7d81161971640e255f334e20b281ef15342dbf2587504bd30d3a94

      (For ppc64le architecture)
      The image digest is ha256:749484f20536a9a75ce57e4fafd57f6216e596256ed2f712a769ebb3e7c785f4

      (For aarch64 architecture)
      The image digest is sha256:b5c055b54ca8581f11a3acfd72bcace0319f6f9aca35f834996fa579b6543dd9

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:a93c65b0f9de1d2e29641fbeebc07178733db1cacc7bde178033d7b9183540bc

      (For s390x architecture)
      The image digest is sha256:5c30783384a38dfad2a76e238c00a179a96672f55b1b17019a791215e4d56ae4

      (For ppc64le architecture)
      The image digest is sha256:b3795cee96197d59fdde5cd5b974db7f9d5f17518233acc0f0aacc5db519b84f

      (For aarch64 architecture)
      The image digest is sha256:2241c79bb208d178f7f66ee37dd2faa011b7154713d2a64aafdadfb391d56cf5

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:3482dbdce3a6fb2239684d217bba6fc87453eff3bdb72f5237be4beb22a2160b

      (For s390x architecture)
      The image digest is sha256:3bb1850f4d09ad42d29b6c08d9e37826f94bd5553dc63ab0ba8af808c4674fd2

      (For ppc64le architecture)
      The image digest is sha256:c0ccf9abb281831b019fb0f2967de9ced0b56259313020b3787f72038f2dbd14

      (For aarch64 architecture)
      The image digest is sha256:9ab7debef422a7d96278d3df314c92b3d842409928aa9a0d960cd2e94529a8b6

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before you apply this update, make sure all previously released errata
that are relevant to your system are applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before you apply this update, make sure all previously released errata
that are relevant to your system are applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat OpenShift Pipelines is a cloud-native, continuous integration and
continuous delivery (CI/CD) solution based on Kubernetes resources.
It uses Tekton building blocks to automate deployments across multiple
platforms by abstracting away the underlying implementation details.
Tekton introduces a number of standard custom resource definitions (CRDs)
for defining CI/CD pipelines that are portable across Kubernetes distributions.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index
Before applying this update, make sure all previously released errata relevant to your system have been applied.

The steps to apply the upgraded images are different depending on the installation plan approval policy you used
when installing the cert-manager Operator for Red Hat OpenShift.

- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a
new version of the Operator. No further action is required to upgrade. This is the default setting.

- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.

See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional
information.
As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.