chore(deps): update registry.redhat.io/openshift4/ose-oauth-proxy docker digest to ef10b2e [security] - abandoned

[konflux-internal-p02]

This PR contains the following updates:

Package	Type	Update	Change
registry.redhat.io/openshift4/ose-oauth-proxy	final	digest	3e78ec8 -> ef10b2e

---

golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws

CVE-2025-22868

More information

Details

A flaw was found in the golang.org/x/oauth2/jws package in the token parsing component. This vulnerability is made possible because of the use of strings.Split(token, ".") to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-22868
• https://bugzilla.redhat.com/show_bug.cgi?id=2348366
• https://www.cve.org/CVERecord?id=CVE-2025-22868
• https://nvd.nist.gov/vuln/detail/CVE-2025-22868
• https://go.dev/cl/652155
• https://go.dev/issue/71490
• https://pkg.go.dev/vuln/GO-2025-3488

---

golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

CVE-2025-30204

More information

Details

A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-30204
• https://bugzilla.redhat.com/show_bug.cgi?id=2354195
• https://www.cve.org/CVERecord?id=CVE-2025-30204
• https://nvd.nist.gov/vuln/detail/CVE-2025-30204
• https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3
• https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp
• https://pkg.go.dev/vuln/GO-2025-3553

---

libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2

CVE-2025-6021

More information

Details

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-6021
• https://bugzilla.redhat.com/show_bug.cgi?id=2372406
• https://www.cve.org/CVERecord?id=CVE-2025-6021
• https://nvd.nist.gov/vuln/detail/CVE-2025-6021

---

sudo: LPE via host option

CVE-2025-32462

More information

Details

A privilege escalation vulnerability was found in Sudo. In certain configurations, unauthorized users can gain elevated system privileges via the Sudo host option (-h or --host). When using the default sudo security policy plugin (sudoers), the host option is intended to be used in conjunction with the list option (-l or --list) to determine what permissions a user has on a different system. However, this restriction can be bypassed, allowing a user to elevate their privileges on one system to the privileges they may have on a different system, effectively ignoring the host identifier in any sudoers rules. This vulnerability is particularly impactful for systems that share a single sudoers configuration file across multiple computers or use network-based user directories, such as LDAP, to provide sudoers rules on a system.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-32462
• https://bugzilla.redhat.com/show_bug.cgi?id=2374692
• https://www.cve.org/CVERecord?id=CVE-2025-32462
• https://nvd.nist.gov/vuln/detail/CVE-2025-32462
• https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host
• https://www.sudo.ws/security/advisories/host_any/

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: konflux-internal-p02[bot]

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @konflux-internal-p02[bot]. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[konflux-internal-p02]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.