VDB
RHSA-2025%3A11351
RHSA-2025%3A11351
PUBLISHED
CVSS 3.0999999046325684 LOW
A flaw was found in the golang-jwt package. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they can miss the embedded `jwt.ErrTokenSignatureInvalid`, and thus, potentially accept invalid tokens.
Risk Scores
CVSS 3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-deployer@sha256:854e438c151ae8aa857382bb8062516187509a5eca3ff46388f161aa4968af49_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-deployer@sha256:854e438c151ae8aa857382bb8062516187509a5eca3ff46388f161aa4968af49_amd64, openshift4/ose-deployer@sha256:854e438c151ae8aa857382bb8062516187509a5eca3ff46388f161aa4968af49_amd64, openshift4/ose-deployer@sha256:854e438c151ae8aa857382bb8062516187509a5eca3ff46388f161aa4968af49_amd64 |
| Red Hat | openshift4/ose-vmware-vsphere-csi-driver-operator-rhel8@sha256:2900d63e5a59fcf1c6fb1e5f5cede1ea9778507ed3083ce75f9f06c68525c937_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-vmware-vsphere-csi-driver-operator-rhel8@sha256:2900d63e5a59fcf1c6fb1e5f5cede1ea9778507ed3083ce75f9f06c68525c937_amd64, openshift4/ose-vmware-vsphere-csi-driver-operator-rhel8@sha256:2900d63e5a59fcf1c6fb1e5f5cede1ea9778507ed3083ce75f9f06c68525c937_amd64, * |
| Red Hat | openshift4/ose-olm-operator-controller-rhel8@sha256:c90c8c6b08fd3543497705516ab446df0fee9559826f0fec603f898e1e98a14d_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-olm-operator-controller-rhel8@sha256:c90c8c6b08fd3543497705516ab446df0fee9559826f0fec603f898e1e98a14d_s390x, *, openshift4/ose-olm-operator-controller-rhel8@sha256:c90c8c6b08fd3543497705516ab446df0fee9559826f0fec603f898e1e98a14d_s390x |
| Red Hat | openshift4/ose-csi-livenessprobe@sha256:9092c7ac46be0a7066a7b7f0fd1db38873066858255f18e3e51016a70412d24c_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-csi-livenessprobe@sha256:9092c7ac46be0a7066a7b7f0fd1db38873066858255f18e3e51016a70412d24c_arm64, *, openshift4/ose-csi-livenessprobe@sha256:9092c7ac46be0a7066a7b7f0fd1db38873066858255f18e3e51016a70412d24c_arm64 |
| Red Hat | openshift4/ose-installer-altinfra-rhel8@sha256:8c581892b08abdb95fd0f03675f5b6a4bcc4a0328be6841c41d08b9b5ba8c52e_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-installer-altinfra-rhel8@sha256:8c581892b08abdb95fd0f03675f5b6a4bcc4a0328be6841c41d08b9b5ba8c52e_ppc64le, openshift4/ose-installer-altinfra-rhel8@sha256:8c581892b08abdb95fd0f03675f5b6a4bcc4a0328be6841c41d08b9b5ba8c52e_ppc64le |
| Red Hat | openshift4/ose-monitoring-plugin-rhel8@sha256:f91380557bfd6ce8f000efe02a787e0dd247c60720d291416314fc678e72f1e0_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-monitoring-plugin-rhel8@sha256:f91380557bfd6ce8f000efe02a787e0dd247c60720d291416314fc678e72f1e0_s390x, openshift4/ose-monitoring-plugin-rhel8@sha256:f91380557bfd6ce8f000efe02a787e0dd247c60720d291416314fc678e72f1e0_s390x, openshift4/ose-monitoring-plugin-rhel8@sha256:f91380557bfd6ce8f000efe02a787e0dd247c60720d291416314fc678e72f1e0_s390x |
| Red Hat | openshift4/ose-csi-livenessprobe-rhel8@sha256:7303cec6134db6c83f9635d5de76478207488779e869da7f337e223a53e80bd2_s390x as a component of Red Hat OpenShift Container Platform 4.15 | *, *, openshift4/ose-csi-livenessprobe-rhel8@sha256:7303cec6134db6c83f9635d5de76478207488779e869da7f337e223a53e80bd2_s390x |
| Red Hat | openshift4/ose-thanos-rhel8@sha256:1de5868b9c7dff7e74e83351efd1f7c90f830231c0fd83b36929e411376d73f3_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-thanos-rhel8@sha256:1de5868b9c7dff7e74e83351efd1f7c90f830231c0fd83b36929e411376d73f3_amd64, openshift4/ose-thanos-rhel8@sha256:1de5868b9c7dff7e74e83351efd1f7c90f830231c0fd83b36929e411376d73f3_amd64, openshift4/ose-thanos-rhel8@sha256:1de5868b9c7dff7e74e83351efd1f7c90f830231c0fd83b36929e411376d73f3_amd64 |
| Red Hat | openshift4/ose-installer@sha256:bc3f31c5a0735d6d50b24f70f95742aa9f34292fc00e0853d7ba09af4d140855_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-installer@sha256:bc3f31c5a0735d6d50b24f70f95742aa9f34292fc00e0853d7ba09af4d140855_arm64, *, * |
| Red Hat | rhcos@sha256:3007911814b540cd87e7092a3ddbe123e63478531ff69856972c7a82cc445b50_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, rhcos@sha256:3007911814b540cd87e7092a3ddbe123e63478531ff69856972c7a82cc445b50_ppc64le, rhcos@sha256:3007911814b540cd87e7092a3ddbe123e63478531ff69856972c7a82cc445b50_ppc64le |
| Red Hat | openshift4/cloud-network-config-controller-rhel8@sha256:5c78e54b72a75a2c2360021cb296274bf1c73494beecdc64a80565151210c31e_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/cloud-network-config-controller-rhel8@sha256:5c78e54b72a75a2c2360021cb296274bf1c73494beecdc64a80565151210c31e_arm64, openshift4/cloud-network-config-controller-rhel8@sha256:5c78e54b72a75a2c2360021cb296274bf1c73494beecdc64a80565151210c31e_arm64 |
| Red Hat | openshift4/cloud-network-config-controller-rhel8@sha256:cd00374591beaf292248fbc2128b640c509ce5246b49199b869f023c73ecd57f_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/cloud-network-config-controller-rhel8@sha256:cd00374591beaf292248fbc2128b640c509ce5246b49199b869f023c73ecd57f_s390x, openshift4/cloud-network-config-controller-rhel8@sha256:cd00374591beaf292248fbc2128b640c509ce5246b49199b869f023c73ecd57f_s390x, openshift4/cloud-network-config-controller-rhel8@sha256:cd00374591beaf292248fbc2128b640c509ce5246b49199b869f023c73ecd57f_s390x |
| Red Hat | openshift4/ose-cluster-olm-operator-rhel8@sha256:4fc4f208d5b8d39943fcc25753f707a88a82ecb6dea2814c79a716e93620fa77_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cluster-olm-operator-rhel8@sha256:4fc4f208d5b8d39943fcc25753f707a88a82ecb6dea2814c79a716e93620fa77_s390x, openshift4/ose-cluster-olm-operator-rhel8@sha256:4fc4f208d5b8d39943fcc25753f707a88a82ecb6dea2814c79a716e93620fa77_s390x, openshift4/ose-cluster-olm-operator-rhel8@sha256:4fc4f208d5b8d39943fcc25753f707a88a82ecb6dea2814c79a716e93620fa77_s390x |
| Red Hat | openshift4/ose-prometheus@sha256:5419a9648d98d7f2b84d957e04f66c85089ae9a9d3acc3caf46d80d920d80340_s390x as a component of Red Hat OpenShift Container Platform 4.15 | *, openshift4/ose-prometheus@sha256:5419a9648d98d7f2b84d957e04f66c85089ae9a9d3acc3caf46d80d920d80340_s390x, openshift4/ose-prometheus@sha256:5419a9648d98d7f2b84d957e04f66c85089ae9a9d3acc3caf46d80d920d80340_s390x |
| Red Hat | openshift4/ose-prom-label-proxy@sha256:26d49d3f36181716aa16225c998a40499dc80a31cb700a3a7a9426fa54ce276a_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-prom-label-proxy@sha256:26d49d3f36181716aa16225c998a40499dc80a31cb700a3a7a9426fa54ce276a_arm64, openshift4/ose-prom-label-proxy@sha256:26d49d3f36181716aa16225c998a40499dc80a31cb700a3a7a9426fa54ce276a_arm64, openshift4/ose-prom-label-proxy@sha256:26d49d3f36181716aa16225c998a40499dc80a31cb700a3a7a9426fa54ce276a_arm64 |
| Red Hat | openshift4/ose-pod-rhel9@sha256:6ccacae86394786f5e8587408b674b0484dd8564733884e946da8c0026072b43_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-pod-rhel9@sha256:6ccacae86394786f5e8587408b674b0484dd8564733884e946da8c0026072b43_ppc64le, *, * |
| Red Hat | openshift4/ose-cli-artifacts@sha256:e5d25c0cbef6cedcbed78e5e8870667da7eebe51c3dad06b41ca79d477f7d464_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-cli-artifacts@sha256:e5d25c0cbef6cedcbed78e5e8870667da7eebe51c3dad06b41ca79d477f7d464_ppc64le, openshift4/ose-cli-artifacts@sha256:e5d25c0cbef6cedcbed78e5e8870667da7eebe51c3dad06b41ca79d477f7d464_ppc64le, openshift4/ose-cli-artifacts@sha256:e5d25c0cbef6cedcbed78e5e8870667da7eebe51c3dad06b41ca79d477f7d464_ppc64le |
| Red Hat | openshift4/ose-agent-installer-api-server-rhel8@sha256:6aa37d5cc69fb18df511c5052d3e4c663c8b9095021e397f3dd80f74ee03d388_s390x as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-agent-installer-api-server-rhel8@sha256:6aa37d5cc69fb18df511c5052d3e4c663c8b9095021e397f3dd80f74ee03d388_s390x, openshift4/ose-agent-installer-api-server-rhel8@sha256:6aa37d5cc69fb18df511c5052d3e4c663c8b9095021e397f3dd80f74ee03d388_s390x, openshift4/ose-agent-installer-api-server-rhel8@sha256:6aa37d5cc69fb18df511c5052d3e4c663c8b9095021e397f3dd80f74ee03d388_s390x |
| Red Hat | openshift4/ose-multus-route-override-cni-rhel8@sha256:4750f887624039878ddda0f13645f95c5c4cdb8189822227a89357e1d9a08664_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-multus-route-override-cni-rhel8@sha256:4750f887624039878ddda0f13645f95c5c4cdb8189822227a89357e1d9a08664_amd64, openshift4/ose-multus-route-override-cni-rhel8@sha256:4750f887624039878ddda0f13645f95c5c4cdb8189822227a89357e1d9a08664_amd64, openshift4/ose-multus-route-override-cni-rhel8@sha256:4750f887624039878ddda0f13645f95c5c4cdb8189822227a89357e1d9a08664_amd64 |
| Red Hat | openshift4/ose-container-networking-plugins-rhel8@sha256:1a32e03076d97c5ceb44d9eaa97398cd3b4edae9d2ec288862088c9c4f562753_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | openshift4/ose-container-networking-plugins-rhel8@sha256:1a32e03076d97c5ceb44d9eaa97398cd3b4edae9d2ec288862088c9c4f562753_ppc64le, openshift4/ose-container-networking-plugins-rhel8@sha256:1a32e03076d97c5ceb44d9eaa97398cd3b4edae9d2ec288862088c9c4f562753_ppc64le, openshift4/ose-container-networking-plugins-rhel8@sha256:1a32e03076d97c5ceb44d9eaa97398cd3b4edae9d2ec288862088c9c4f562753_ppc64le |
…and 547 more
Timeline
- Jul 23, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:11351 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://issues.redhat.com/browse/OCPBUGS-36371 advisory
- https://issues.redhat.com/browse/OCPBUGS-57521 advisory
- https://issues.redhat.com/browse/OCPBUGS-58459 advisory
- https://issues.redhat.com/browse/OCPBUGS-58506 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11351.json advisory
- https://access.redhat.com/security/cve/CVE-2024-51744 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2323735 issue
- https://www.cve.org/CVERecord?id=CVE-2024-51744 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-51744 advisory
- https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory