RHSA-2025:0650HighCVSS 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.16.32 bug fix and security update

Published
January 29, 2025
Last Modified
August 22, 2026

🔗 CVE IDs covered (3)

CVE-2023-6597 →CVE-2024-21626 →CVE-2024-45338 →

📋 Description

CVE-2023-6597 — python: Path traversal on tempfile.TemporaryDirectory CVE-2024-21626 — runc: file descriptor leak CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html

🎯 Affected products119

  • Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:296a94de7bc2558d2faabc65b1859d2963977ce20281ff59667052e244c46b8f_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:4ac87ac404534c5e22c7583666fa2bf34bea52dceb59ad05d93f1c7f9c7d05b6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:a486a54697c2c3bd49b3fd739f583da9e01f5174556e9f8290b46391f8e89a2c_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:b4028789187d6e7679570ca9ec06a0a11bd0d46da3b8286435592b89dc0493c0_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/oc-mirror-plugin-rhel9@sha256:32c6964a899a9809b49ba736af950a96681e81c4acb72abd8f451e8c5be8b930_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/oc-mirror-plugin-rhel9@sha256:4b1b48132d58b4ad1f6a21972b92ab58b3a5da7d5a475eaa3d02a335dec99ce7_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/oc-mirror-plugin-rhel9@sha256:eb79ae7b22958067c27c58bd460af1f2a8504eae7a69f8c4e98ed09b4b5432c1_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/oc-mirror-plugin-rhel9@sha256:f5e545ba9260068217c2efba5608dd3f071b9eb32395d881401aaeca0250dde8_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:044b3996a08bbb72f4dce38a9eab9990d8eebd1887352317ea253bf4adfba11a_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:539d3cce9c0356979b3ec532b339c97212b0ce6eea2e5d8e8b82581ef7986df6_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:9fb647ebaf047467d6fdddff21384db982a4ca6de1b24225a08f16e31d2e4625_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:c77ff80efc4c193c9fcd6a93c052a5e606366c96d783352376a8e5353a7db1ff_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:0bf83b36f3ae353fb9574fb8868bf873d61f64e8952ed3b9c3b992a8c6227752_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:373799df51c8be3afd67be9d342c18ae80c6b1b797c157f0565767f50553c697_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:7aedef98a1bccb6b46b72c290c98a43e542489b6713ea8d8e1e64106572fdd69_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:a75819dd36aed545acfdec849fa4e017345175b7f1200923de6c758ca125b40d_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:46dbe06a9380d8c367cc0a799a0d6279c7367317cefe9215b49aad11346611ca_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:d14832d2d4f99a82ad21b0262f351abf9a6d85f0e32e2d4ba17e2725b481cff2_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:f06972ab64c42afa1b9865cbdeb5989aff135241c8b71e0afb6f54b33c5644f2_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:f8fae9787458948081a48f0077f4cb4b0d2357507efe679efcd71b5ad6a1491a_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:2422c417846fa0c4362bb9739b982432562db1c81eb1fce2d46be5712913bb39_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:417f8e91fe2a7ffe72cf56fe220911358802d74d183dc0d28d28ec0076cd9235_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:8cbb53b49ec3513f6b95899c25791224b5bb30fb60f2c88f2f2aa2476d3136ce_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:e615bdb9b98344e54c408570c85d358466f70e1c15add57a7ebeadd445346be2_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-baremetal-installer-rhel9@sha256:59517046416a43de8a20e32795b80e07c74cccdffb50d7ba2d38f9be69917056_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-baremetal-installer-rhel9@sha256:62f9982e0cdede04e40ceebb3681b540561283daef1b9cb3a667108a75e5a93b_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-baremetal-installer-rhel9@sha256:6e17b26b19f79fd67a7c4299be6ec9fdd5af4b94121a269a40b74226478870f0_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-baremetal-installer-rhel9@sha256:c26e2befbca5bf8600db879930db686dfed955f5ed18cacb76bf5d0c91ea7297_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-baremetal-machine-controllers-rhel9@sha256:072be9c2b217d20694a1f1f984c9a9418f2e2ced0984546c277c032f5b6417a6_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • +89 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:0e71cb61694473b40e8d95f530eaf250a62616debb98199f31b4034808687dae (For s390x architecture) The image digest is sha256:9a9994d9b6b56faf3d158e479e87f15ede5783c7408433129547c917d1c90fcc (For ppc64le architecture) The image digest is sha256:cf6a70ea1b63cb49fca5aae3de7991d2c9321343943967f4653827f328ccef3a (For aarch64 architecture) The image digest is sha256:0a52bafb899c924f448612b7ca6bb96a9062cd80385d3f9aa567aebac97931e5 All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat Enterprise Linux (RHEL) and OpenShift ships with SELinux in targeted enforcing mode, which prevents the container processes from accessing host content and mitigates this attack. Dockerfiles can be inspected on the 'RUN' and 'WORKDIR' directives to ensure that there are no escapes or malicious paths, which are an indication of compromise. Limiting access and only using trusted container images can help prevent unauthorized access and malicious attacks.

🔗 References (31)