SB2025112552 - Multiple vulnerabilities in Red Hat build of Cryostat
Published: November 25, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Race condition (CVE-ID: CVE-2025-47907)
The vulnerability allows an attacker to tamper with the application.
The vulnerability exists due to a race condition when canceling a DB query. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system. A remote user can overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-58056)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP/1.1 requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-56433)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to shadow-utils establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users).
4) Buffer overflow (CVE-ID: CVE-2025-6965)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing aggregated terms. A remote attacker can pass specially crafted input to the application where the number of aggregate terms exceeds the number of columns available, trigger memory corruption and perform a denial of service (DoS) attack.
5) Resource exhaustion (CVE-ID: CVE-2025-8677)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when querying for data within a specially crafted zone containing certain malformed DNSKEY records. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Out-of-bounds write (CVE-ID: CVE-2025-9230)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when trying to decrypt CMS messages encrypted using password based encryption. A remote attacker can trigger an out-of-bounds write and execute arbitrary code on the target system.
Successful exploitation of the vulnerability requires that password based (PWRI) encryption support in CMS messages is enabled.
7) Insufficient verification of data authenticity (CVE-ID: CVE-2025-40778)
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to insufficient verification of data authenticity when accepting records from answers. A remote attacker can inject forged data into the cache leading to DNS cache poisoning.
8) Predictable Seed in Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2025-40780)
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to weakness in the Pseudo Random Number Generator (PRNG). A remote attacker can predict the source port and query ID that BIND will use and perform DNS cache poisoning attacks.
9) Path traversal (CVE-ID: CVE-2025-53905)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to input validation error when processing directory traversal sequences in tar.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution.
10) Path traversal (CVE-ID: CVE-2025-53906)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to input validation error when processing directory traversal sequences in zip.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution.
Remediation
Install update from vendor's website.