RHSA-2025:12323HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.79 bug fix and security update

Published
August 7, 2025
Last Modified
August 20, 2026

🔗 CVE IDs covered (2)

CVE-2025-22868 →CVE-2025-32462 →

📋 Description

CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-32462 — sudo: LPE via host option

🎯 Affected products193

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:99a5af960c8593e12fc9d04e88f8447305790cebbc36973df0fd17355473e7df_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:fdd5931559f49330dae5c4d7b7b6334061872cdcaaaf7d3318d2f66c6938da02_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:8e15f51c7829b1291d371c436937b9590ff9dccd872ced7003ae3e4748170b07_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:98a59cdf423b035c4a5bdf1bfaa8515c7dc1c6a5dbc71df1aa1885b27ac52dc0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:6d3a067238099aef28097a1d166d67c1af76fbb7779239100bca35ff6bf1868f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:52788d87fab95e4da335967708037e4385a6838dec9b4b8c76ab56d8af220097_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:64e62412c176edbef497c57ac54ad617ebf7fdcf16cd2b2b399eaa661fcf8527_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:cfef1f5300b8a5b8e77d09b845642af46505223089fbd4d2ae3b7c8df580da76_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:35d15c650747fc7f3f5f621f65dee4e8265f26166dd4b0dac19e57348e76f714_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:51d350e3071fcd6f0928f8147f3bcc34e25ddd2763162a02300ac488a43d753d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:22d7d5402e2aea532491b284d2c999e19ebbde7c6bb7e4ff460eaaaa5af32474_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:e7b274b793f3e84b191392a1145926c1fe5f679bf10e0640ce3c7f47aac025ea_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:a3ddd9e6505ac35d9a530d6df4e4447a0e54893aa85eaef83a9dce41b7022503_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:4891ec121c4d35ef7224c8c43a4de6df0a856d6ad6019f5d71049a8b03e4c4af_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-machine-controllers-rhel8@sha256:99b82184bf1a99fdcff98e76aa803f117276da1c079c4d93799cc3d5bb3a2d67_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:8969510d1b39fe0a9450c8259011c9d00bbce456f71ed50d1f2fcb97afc3a408_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:2cf28819e162d3267d918be34f6767175d49bc8db9523cf8b12a97e53afc2bda_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:fbfe36ddd043b94c278b9e7ee9c3ca36cf5686f878e1ae032f39a5fd4271b7f7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:52172a1c14683a8e47361c6134e417beebe9741c0dc98be0c48d44793d0b26a3_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:cfc9fc6a680689e59b538c538e55ed06293bb5f1419f8bcf07357d59905b3715_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:0c377af76e5abb143839638632ef6e941a37a41a72313f107f0e568552bb0562_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:2391223e432a5ee35a45fcfc150582ca393a489f63c6f9f53d12a68c936e27c4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-node-manager-rhel8@sha256:4a6f32426c1aa4f121e2a70d10dd5b4e8a9b706282ee8356b8f929fdd77da5dd_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:62a832768f76a373635e7d38d8bd131f5a8fa729bcebd3cc5a50b59a1ef57b17_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:2b29df447c2719b5098d61802c9ea18a553948f7c632280088f49a12a1474e96_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-disk-csi-driver-rhel8@sha256:9ad002512ee2451a99835b1d7afcef75f86884153fc9ae48052b6fd37b71029f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:d6aeab64129bb5bffeaff2d8bc5b99a085092d0778fb69af2fda223e758ef4de_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-file-csi-driver-rhel8@sha256:0558073a7bcf14ab91d6523b4eb3d5474988875dac50638779debff66629a781_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:de47d173ac9abd664a215c010f3a9a39a42cce67e026f2dca4899bc2603832c9_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +163 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:133fd703b5a550fc5be350af24597e0f07c83d7a4b0edfd3d24772342c572e84 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: For environments using sudoers files: Remove rules defined in sudoers files that are for any system other than the local system. For environments using LDAP: Use a narrow-scoped search path in the SSSD configuration so rules that don’t apply to a system are not included in the LDAP query results.

🔗 References (5)