Skip to content
OpenAdvisories
Critical RHSA-2025:0401 2 CVEs

Red Hat Security Advisory: grafana security update

Published Jan 21, 2025 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana 0:9.2.10-21.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana-debuginfo 0:9.2.10-21.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana-debugsource 0:9.2.10-21.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream grafana-selinux 0:9.2.10-21.el8_10

Vulnerabilities 2

  • Critical 9.2
    CVE-2025-21613

    go-git has an Argument Injection via the URL field

    go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to…

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2025-21614

    go-git clients vulnerable to DoS via maliciously crafted Git server replies

    go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing spec…

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2335888
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2335901
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0401.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-21613
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-21613
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-21613
  • article
    https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m
  • advisory
    https://pkg.go.dev/vuln/GO-2025-3368
  • report
    https://access.redhat.com/security/cve/CVE-2025-21614
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-21614
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-21614
  • article
    https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4
  • advisory
    https://pkg.go.dev/vuln/GO-2025-3367