VDB
RHSA-2025%3A19296
RHSA-2025%3A19296
PUBLISHED
CVSS 7 HIGH
A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.
Risk Scores
CVSS 3.1
7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9-operator@sha256:4f676c0af5e75e21d4d7f81ff5b2c465a363279dc46b20725351477d2d19daee_s390x as a component of Red Hat OpenShift Container Platform 4.2 | *, registry.redhat.io/openshift4/ose-console-rhel9-operator@sha256:4f676c0af5e75e21d4d7f81ff5b2c465a363279dc46b20725351477d2d19daee_s390x |
| Go | database/sql | |
| Red Hat | registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9@sha256:524e6e8118411f491ed5c511a4a382f42846692a8303bb4d2fe56f51386d7d86_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9@sha256:6b42f0f6ad8a26cbcfa814470b50759a255e87a34f727ca669615f5992b7a899_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | *, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9@sha256:6b42f0f6ad8a26cbcfa814470b50759a255e87a34f727ca669615f5992b7a899_arm64 |
| Red Hat | registry.redhat.io/openshift4/ovirt-csi-driver-rhel9-operator@sha256:d0ca8c6c0ee25dbd91a058c1ab1dc13f4977eeddcd930de7403c2c515f8c3c07_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:a854c7eb865bea441789c8402bb2392305352d69510717508510108c5c5c4236_s390x as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:a854c7eb865bea441789c8402bb2392305352d69510717508510108c5c5c4236_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:3a204d623bdbd4aa5dff892a16a70691d0f288cabec5b75584c44851b42213fb_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:3a204d623bdbd4aa5dff892a16a70691d0f288cabec5b75584c44851b42213fb_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9-operator@sha256:3d510e969d31e487fa0e308d72ad24bfca555da7bac38af53910e46480cef796_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel9-operator@sha256:a97a3df5bb75b997109cb5c4ad38700c6c924acb46545628f9703e8d5cd6863d_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-prom-label-proxy-rhel9@sha256:d8072804c2007661bb2b622c6256b0a2ae4efd3d40e99dc51453cf60aa455d7f_s390x as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-prom-label-proxy-rhel9@sha256:d8072804c2007661bb2b622c6256b0a2ae4efd3d40e99dc51453cf60aa455d7f_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9@sha256:388c8761f73c0e561564cd86b82b5c660f2ac9853f7a49faa5cfc25baaa90c3f_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9@sha256:388c8761f73c0e561564cd86b82b5c660f2ac9853f7a49faa5cfc25baaa90c3f_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:3fb642378d61ea57e862936f477c167d8af333def4319a28285c830b41205f2f_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:3fb642378d61ea57e862936f477c167d8af333def4319a28285c830b41205f2f_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-docker-registry-rhel9@sha256:daab2f22b855072a382a75a7cec2b904824f673bab5a6181ef17aea9fcc5f8c9_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | *, registry.redhat.io/openshift4/ose-docker-registry-rhel9@sha256:daab2f22b855072a382a75a7cec2b904824f673bab5a6181ef17aea9fcc5f8c9_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-authentication-rhel9-operator@sha256:fbdd807107c7c227a8c31ce6d11ac0af06c4dc4bce4f32a7b4e0d9a40d97f600_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-cluster-authentication-rhel9-operator@sha256:fbdd807107c7c227a8c31ce6d11ac0af06c4dc4bce4f32a7b4e0d9a40d97f600_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:8946bde659264298089a85fefe27ee96bba14640ec5593386bb4a5071413f9e1_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:8946bde659264298089a85fefe27ee96bba14640ec5593386bb4a5071413f9e1_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-route-override-cni-rhel9@sha256:47d616dba30e1721be16b334cfa667dda649ca05491f0d88fdfffa7d6a89e7b7_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-multus-route-override-cni-rhel9@sha256:47d616dba30e1721be16b334cfa667dda649ca05491f0d88fdfffa7d6a89e7b7_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-api-rhel9@sha256:064cafefb53ccd0455ce3a4d78c4189cb3c96e57532c947f779ff06843adadf1_s390x as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ose-cluster-api-rhel9@sha256:064cafefb53ccd0455ce3a4d78c4189cb3c96e57532c947f779ff06843adadf1_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel9@sha256:6a20d76fdb95f4c4babb0f1cdc399fd10c01490416c64dc646625f8374aa6892_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | *, * |
| Red Hat | registry.redhat.io/openshift4/ovirt-csi-driver-rhel9@sha256:91df2528220bb7cc5d866768048a47f6f90f0ca82c288e6330149be7e754297f_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | registry.redhat.io/openshift4/ovirt-csi-driver-rhel9@sha256:91df2528220bb7cc5d866768048a47f6f90f0ca82c288e6330149be7e754297f_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-machine-controllers-rhel9@sha256:aa1fbd59a9553f299ba080d52724b4880ff506dcb0907772b626d0807b6e4f7f_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | *, * |
…and 631 more
Timeline
- Nov 4, 2025 CVE Published
- May 7, 2026 Distribution Patch
- May 7, 2026 Distribution Patch
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- Jul 26, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:19296 advisory
- https://access.redhat.com/security/cve/CVE-2025-47907 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19296.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2387083 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47907 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47907 advisory
- https://go.dev/cl/693735 advisory
- https://go.dev/issue/74831 advisory
- https://groups.google.com/g/golang-announce/c/x5MKroML2yM advisory
- https://pkg.go.dev/vuln/GO-2025-3849 advisory