RHEA-2025:3152HighCVSS 8.2

Red Hat Enhancement Advisory: OpenShift Virtualization 4.18.1 Images

Published
March 25, 2025
Last Modified
October 31, 2026

🔗 CVE IDs covered (5)

CVE-2024-45337 →CVE-2024-45338 →CVE-2025-21613 →CVE-2025-21614 →CVE-2025-27144 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-21613 — go-git: argument injection via the URL field CVE-2025-21614 — go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service

🎯 Affected products160

  • CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-controller-rhel9@sha256:b68ad03c9433f73a6d9da1039995b333a3a68eaae7cc8c65c7cc95d58847fbe8_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-controller-rhel9@sha256:c3ca24c154f5ca17fa5ca818415cfdf715bf4cda499dce941ba951cdad927c63_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-controller-rhel9@sha256:dab6e868c14623ae59a5088e5d2dfdf72d881651498cfb9106d822c5835bfa70_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-operator-rhel9@sha256:51719ce454d35e4138da15de828bf81a372a58eb98b5d4e513e88bb9c716560c_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-operator-rhel9@sha256:757c7e4cc5b90c9582dc007724cb66e76f35869a140f321f912fa3b862ba9054_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-operator-rhel9@sha256:819363f4c971d0713f67155d53b04894bb05ad42621ba191358a403956c174af_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-server-rhel9@sha256:651837f12c68ae521b80c8bea6d18e99a75ab01e9c65064ee5d87e9d6cce1b1c_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-server-rhel9@sha256:e3cee2095e02fb2eed3535d200ed3410a81e78f4abb0c7aaf6f2b943554dd2d7_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/aaq-server-rhel9@sha256:ecc8a5f9ae740d551ce1f100ad1012f2c73c5305af22f5757bb409d6347322b6_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:29444609b16da5ba947c0b33d8308ddaf0037e2ebfd6091ab7469cd6aba1d686_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:2c588825ce6598d04a51cdb0ef57bbcba3e0e33b7c63621f5d411635ad051d69_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:cd2e0762ecb380b37376b8c715c83204755357b9957bc59ebf5e59b23138393e_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:0f97af72b1b719e63c655bbc3f4aedfa12256b27c911012dc51f328f0266849f_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:6e340137fdf53bc33e26b681cb186de57f0808e896ea4dc42237ae58aaf2e71b_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:9df9d2d81eb66a23f4c42febfa34df055ee6c2f0a2332392a6fa2a2add0144ea_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:bf1f473d9d0d549cbea8359ceb512b8bbe869df782f5c73c6d8df1a5866b7833_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:d0feb6da0169b88042c04e792ba7d9088c8136a27ba7f150b9dde1d719ffc53e_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:e91ac8174a65d37e53590c65754e67994712518a57f3d319ef34e9a0148b66ae_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:681df6c61d12c1d2aa761fc2df392172872bd608c469312a8eb933745b7376bb_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:7cf4304a55abd890e653ac341ad03b8f51d580e39ea8ee4c5acaac5ba873a147_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:f621cbad5f55e91c7e492ba627f7c4ead0e061eab5e2a5771687180a869e42ca_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:00e1bba6433a855c70d34e5d100ce5e35c9b11b4d2af97b6408d6cc36ae518d6_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:3bb09634636e2bddf0734d074450a457d13c5d24254d83b7b8d95651bdb2d562_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:56e06163be710f0960b8a96a0540a3870cae36a501739b843fafc133188aa7fe_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:3efd88fb0aa49965e4d3c1fa75ecc9633d8b79a8b3d1a1cfbcb6dc67ffca5092_s390x as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:58a7903552db6dde42e66071112047ec844741e1a85fe5139ca6e9133459db2f_arm64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:89c5a80298e2ee99ea32db637bd3989691e92e16acbc18fd7cc0bbaa00321482_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:2be5564d8b9cf7cca434cdd35233b0277036ef7c5919949b52401cb822c387d2_amd64 as a component of CNV 4.18 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:94247263d95a437e364685455aad9dfe2bd320efd63b74548712e5db2500f487_arm64 as a component of CNV 4.18 for RHEL 9
  • +130 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.

🔗 References (12)