RHSA-2024:11038HighCVSS 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.19.0 bug fix and security update

Published
June 17, 2025
Last Modified
September 8, 2026

🔗 CVE IDs covered (6)

CVE-2024-45338 →CVE-2025-22868 →CVE-2025-22869 →CVE-2025-27144 →CVE-2025-29781 →CVE-2024-45337 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-29781 — baremetal-operator/apis: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-karpenter-provider-aws-rhel9@sha256:da00b37b5a73b1cdf5c16b589e84d889e9d358fc464598d3c4712d82e4aa67d7_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-karpenter-provider-aws-rhel9@sha256:e3cad8147b30fb844c43e0b141a44d136eeebe6ac0645d82b763c4dfc18d6771_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-karpenter-provider-aws-rhel9@sha256:f55a3818599acd52eb64399f871c5f5427325e8e7ec7d9bda0b0ae994a55394c_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-karpenter-provider-aws-rhel9@sha256:ff48e851b1e866324d784e34cd36e38eef87484aab9c0639485da6eb961ad5cf_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:4ab44131b2cb3b6ca4edce4a21228d092eb9e394d60c904c85e529a20c341626_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:b10e872f66fddc30b0807110231f74f7441e8b393a91a8f9bcace37ab98ace73_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:c36528eb28e5012f9c794aed0567ae527a46210c193ca5dce20f70a694008461_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:d44b27953826e6fd4b33c9b44dcd07fb15f622004a08c484f48940f4bf788634_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:3d930726be74d58ce21451fabb2c5a4de5abb5a7990f06540cd0ab43213ab07d_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:6ff2b850f84a7c3b6f3a543320a9a21fb1374454563430dcf28430206781f195_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:8a51d40500d4013da48203189481a217d7387c6b756077d91a38071470b23bbd_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:fb1e071024cabf1dc6f35aefc247aca90c77267ae46cbb4b7a99134ca3458ef2_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-service-rhel9-operator@sha256:860f15a74ae06675db03194d377964575f6c03a6515b793f015d22c8b7d5aaf2_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-service-rhel9-operator@sha256:af7c46d525fbd2494a5a19fb549be1f017f9f8dd0a24049d2c0107396f48fa48_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-service-rhel9-operator@sha256:b47e4cb3796c52e993e139f67d2caf98748311acf83d3bd9912a0d6634c24e28_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/azure-service-rhel9-operator@sha256:d7b541ad17a1d0bbb67601a0637484c709bb4f8bfc81aa65400dfac9dbacda11_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/cloud-network-config-controller-rhel9@sha256:a497efe9b6e77e7fea511099462c23ea824939208098a8f4df4ff2e531e81cab_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/cloud-network-config-controller-rhel9@sha256:c2fe23659c0446480a463b5d84ef2236d817f8657794440b84a64a59a02fa750_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/cloud-network-config-controller-rhel9@sha256:c59fa642d37e4081c89fb1605dc0ee7d9ddbac246ba5ef7b1c6871bdc08d9427_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/cloud-network-config-controller-rhel9@sha256:f17ca90342a7a8045830039077b7c8c029989c76d7d9ebf84710eaa212c0738d_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:3d16b508e629f3bb503938bef9b00fa9e012e89ca4be8317fd04cc353960fb32_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:3f35cfc1ab56731f65fd4cd823818a69d1d7a79e9a66dea2b42278103820f280_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:577cd34fe1f0a7f77649550f9f1ef89c6c2c62a583b794ea1f46ebc5555b50d2_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:86aad83cff56444dbb74fdaab7c6615fcf0be393d8628372d2259c30b534e108_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/driver-toolkit-rhel9@sha256:19fc4443bcb387f5916ec700c90f8de839cf99ce279299b724eb2c9c7876f449_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/driver-toolkit-rhel9@sha256:58739e57dad22a381a3c57b3f5ed8dc8957012eb9e8120974de12f1f2bd2f728_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/driver-toolkit-rhel9@sha256:d8e8972c49565ed7a6175f6d0d229b9f4b4711fb888f0c6eeda22b82f8732383_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/driver-toolkit-rhel9@sha256:fe0322730440f1cbe6fffaaa8cac131b56574bec8abe3ec5b462e17557fecb32_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • openshift4/egress-router-cni-rhel9@sha256:2a6eef1e29be5f2245a9003314d6cc86cf82bea9715008337a5a361a0b4d8588_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:3482dbdce3a6fb2239684d217bba6fc87453eff3bdb72f5237be4beb22a2160b (For s390x architecture) The image digest is sha256:3bb1850f4d09ad42d29b6c08d9e37826f94bd5553dc63ab0ba8af808c4674fd2 (For ppc64le architecture) The image digest is sha256:c0ccf9abb281831b019fb0f2967de9ced0b56259313020b3787f72038f2dbd14 (For aarch64 architecture) The image digest is sha256:9ab7debef422a7d96278d3df314c92b3d842409928aa9a0d960cd2e94529a8b6 All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters. Workaround: Operator can configure BMO role-based access control (RBAC) to be namespace scoped instead of cluster scoped to prevent BMO from accessing Secrets from other namespaces, or use the `WATCH_NAMESPACE` configuration option to limit BMO to a single namespace.

🔗 References (996)