6.5
Medium
CVE-2025-4374 A flaw was found in Quay
Description
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| quay 3.12 | 3.12.0 → < 3.12.10 | 3.12.10 |
| quay 3.11 | earliest → < 3.11.11 | 3.11.11 |
| quay 2.14 | 2.14.0 → < 3.14.2 | 3.14.2 |
| Red Hat Quay 3 3.12 | earliest → < 3.12.10-3 | 3.12.10-3 |
References
- RHBA-2025:8262 access.redhat.com
- RHBA-2025:8263 access.redhat.com
- RHBA-2025:8687 access.redhat.com
- RHBA-2025:8688 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2364267 bugzilla.redhat.com
Timeline
- Published
- Last modified