RHSA-2025:1704HighCVSS 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.16.36 security and extras update

Published
February 27, 2025
Last Modified
August 6, 2026

🔗 CVE IDs covered (2)

CVE-2025-21613 →CVE-2025-21614 →

📋 Description

CVE-2025-21613 — go-git: argument injection via the URL field CVE-2025-21614 — go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies

🎯 Affected products37

  • Red Hat OpenShift Container Platform 4.16
  • openshift4/kubernetes-nmstate-rhel9-operator@sha256:1b5af66a03bbee27b42b638518b5d7be74957ffcbc475e9cb7a5e5e739e61ca7_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kubernetes-nmstate-rhel9-operator@sha256:4decb51af068d99b41641772ae0c7c8f68d6778208188349dda869380798904c_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kubernetes-nmstate-rhel9-operator@sha256:8d49093751fc5268b072332a4a81105b78686ade7d1756c944f594a2a68b2376_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kubernetes-nmstate-rhel9-operator@sha256:ec64a214adab3ab56bc4715eabc08cf126233581af89b6aae42efa6c6bd5a77c_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/nmstate-console-plugin-rhel9@sha256:0876977b02c66c9c436e1b709ef0890eb37ba6000cc66b359bc43a82f9c9326d_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/nmstate-console-plugin-rhel9@sha256:6e313156ab2ef86df934c5d99ae44c903ae746ee34f5c5cd30caa208ae5582f0_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/nmstate-console-plugin-rhel9@sha256:c0e47eb928f6c654311d01b6d5da68adc37107121803285e09765bb06425b915_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/nmstate-console-plugin-rhel9@sha256:dc5dcc9ceeea24d521bd2f4bcfedb1f55481e062742241f4f13a94329e1c3477_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel9@sha256:4f2c25fd49437dbbe01c064343441b7a1940bf6e42b434f5cf72f573c75435fa_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel9@sha256:570b11c05d8eb8967714d6168524be2d28f5a83c3e59e267c07144d5df341067_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel9@sha256:7662039b328d514fe1e03bd241f0a24d256f752e2a5f26dde75f29df4c10b686_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel9@sha256:87c9ec8b5274b20529c0b0e5871039259a1e6cd1d407c23975defd524ebb59a7_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-helm-rhel9-operator@sha256:2c73f9f28f5788ec49cac43923e6fff443b2f687930870a3822a92bc62029829_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-helm-rhel9-operator@sha256:592e782c5e1c5d8bd0e12e165e2fa4769db28ee80f36b38caccaa1e94ae01c82_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-helm-rhel9-operator@sha256:7727d785c5c91450aa376e21e048c4dcb9c743013b6d369030c851d9dc576749_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-helm-rhel9-operator@sha256:d469976c1a96d26c42baf02391bcac3994cac27955a10b4753b13e22b2ef4617_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:2d6d320242a0f7ec5b8ee1451e3539122d54f6f7def159baa342c9dee169303f_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:312ebe2043b6984aa93affed5658e8e60808a2635f4beee363a00ff92704039b_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:c9d29ddc6decd6358c7935eb1fcf8a920db2e04bdc6ebe30d09b7db83519a69e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:d9f532de2030bf0c8ea5cb9b2549a8077362e72dbcd0ea876bace2ebe2ebeee7_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-operator-sdk-rhel9@sha256:4a71bf0d426159f85a890c762cc54c831bc5f18cebd58918e00f13d3f381da85_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-operator-sdk-rhel9@sha256:a37bc2569541975dc85b91b0426a2a157b3c1f390c76ea79b11a1437344b1c9e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-operator-sdk-rhel9@sha256:bc2469da8833eec1f137ae8203e17be1cded1ff746da08b78d76037c99979647_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-operator-sdk-rhel9@sha256:eeb1d99595529613cb094b8314fe28cf61692c6b2c670a05f9d2bc2b0e7db7ee_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:69d8ba95cb2698724dc5be762e9403ce82662cd4f65d9ed824592e8b26ce44ae_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:be270a7728e5521da321031734c186f415fa8e9d51d692e8cae7df3e0e2f6919_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:e4858e291d7ad535f4aab83f314b0ab19d875c66fe87fb3538de7571542c4807_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-sriov-network-rhel9-operator@sha256:4b3d4389aac7a0aa4fb350579f78bf1f8b07bc4c0fe846f9b1e27b0abed6aae2_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/ose-sriov-network-rhel9-operator@sha256:79da793b5c71198e6cf79363e45bb15553e167790eae84e62ef461671cff908b_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • +7 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html Workaround: In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.

🔗 References (5)