RHSA-2025:16160HighCVSS 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.15.58 bug fix and security update

Published
September 25, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (3)

CVE-2024-45337 →CVE-2024-45339 →CVE-2025-22869 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45339 — github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:64c02cdb3b2b3cddc646baa3300c12be69a695d0a75f801111f1febb11aba391_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:800be55c1c5e5d0da9f572dffa5fa13d06120078b4040cf488ea3b33ac6b7ef7_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:881c7844c69db796593eb74108599b8503c82ad0d23178a40e134eb05d25c9ae_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:e9a15ef9133d0c44ac9b3710215a1047b0465609018657af42882f2a1c1e56fb_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0c8b73eea4de9c30e060d9fa2539733e98f8cb2b80cfcaa4aee1375f607cd8e0_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:7856428123ed9d22d03e4932374e498d019f13b150f6d0946d8768920fd37dfa_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:cb155860ebd52778c1c834da12703bcc693e8583e9ded76307e5dc76a5411b7a_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e63b0db582fdb134893c4b268451f7dc20265ada9f90550d688bcf7c2cec63be_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:0938ee3deee5f448494dcad4f572cd07526422bf6d750b311c7d944b0ad9dbba_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:573d276221f154ff1843b610a2c4d9e286d97b686525217318166f3742fff3e3_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:a2573fed11e0e38eb4797812385d9f3a0da299c77b4d0e52cc4787f3396350f1_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:cc5d3518b012b98843585911eacdad88be8c69ba43bf24a7d8481a721f7a6f2b_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:426af1583f4de64c4df0faeac797bf0301be7ed0aee8cf91b0f59899effa74e2_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:a42e10ccd3323d07dbf1324f483a5d126ced7d68f5ff2d433abec41da138bebc_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:b990f44fd1f0599de8fb848d9338fa539808c13120c9f542230a8907995c5521_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:fdd1bb3af27317d8aada4f18e3a035768845263546fa00376b5ec64cf6983f2e_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:617211bab647ffe46c31e3f414fa53d5b489c7f745d3df8ca54cc2c7c373e32d_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:77218b7e90e92a3df9c3d975f3932f3eb6ef153b8f214580eb354eded7ee6ba2_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:909bd8da7f1304dabc43c2a9f533010a63615628b32f500e2d16d66332183747_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:d4032dd6581e53ea3a7c19ba988719f1ca7d928869ac3253eeb89810cbfae640_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:396351e2dcb92226af7666a196a9f4f11259eff48ee6db2b1031961cbfa120fe_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:7316d25428cfc53ba24a16d425aa636cff2bd0ba6d0bc6ff733ff13f9c864a01_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:fa3fb603b152a92cdd429df9b02a8f7280297e3bdcabc4480dcb872e2f183a20_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:fe454f8407fd42a9beab3943aaa31dc5d5049fc01e45bbe1191ae4d558775587_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:79414cd4834dd5a2eeefa79ab489edccbff865f8742867c8b1cdc57e04695287_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:9ce3591de3ae6bc5f33cf6d0783debeaaef363fae55f7c3151c249263c75b0b0_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:c1d690ad38a06b78bf3c7799763f8216a8673d4ce53f55c09169d100d873e97c_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:fb154ee0e595b97a5c38cbbd625ef343a72a71c9bff24764fe84848d4975c351_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:737cebf7b00f0e2116f3baa9b6fc5d158e416404cab3eec773e210d8dc030b87_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:427fc0b133cc2aa45a68c36b603403ab278c845c0232e1c59387c4abfff01b9a (For s390x architecture) The image digest is sha256:ba89251bdd0f31c6a05306c3696dcaf38072eacf0b8ad8bfd7d8048b4038ccca (For ppc64le architecture) The image digest is sha256:9b60e5392e2733aab78a7a89f6735620ad229e415737c16b930efe59fe0810dd (For aarch64 architecture) The image digest is sha256:3843de0e1511bbe78f5045f6b7bcfbdc3f0836c9d07d5ec320033c8105a09890 All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers.

🔗 References (6)