Description
A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | mirror-registry | < 2 | 2 |
| Red Hat | MIRROR-REGISTRY-2.0-RHEL-8 | — | — |
| Red Hat | mirror registry for Red Hat OpenShift | — | — |
References
- RHBA-2025:9645 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-3528 vdb-entry
- RHBZ#2359143 issue-tracking