RHSA-2025:17671HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.81 bug fix and security update

Published
October 16, 2025
Last Modified
August 25, 2026

🔗 CVE IDs covered (3)

CVE-2024-45339 →CVE-2025-22868 →CVE-2025-30204 →

📋 Description

CVE-2024-45339 — github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:1757454c48059176b14c570c6c7f05c21174625c2315ef2d1b87254adc354855_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:553361ea6ca860540b6beeeea3bd87d8e5ebc33ada23d04fb3f6fbf2b34c196e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:fb81a74dc0713b2131ea0d8cdca357b0f047483bd90e5fb73fd5bc481d752a4d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:1cf9da24d902e26c96ed05c88435e87504b795988be79a6c5f9c06a4b9bbbad4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:3cff2049958850f98863ab48f1a911e53a1384e845d303b7ede55a88eaf734f4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:3b9662eeb8ede8b5f571b18f5e73ae7a5274210f7ca461c4e58f029cd0dea8c0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:5f5440fbbc1c23bfbe18520591aa340ed2fb470bbd4e06758d95610a114b7c9d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:65e031b1e98466e7d8d10b3f79d102e5615051986cc899ab2e3bd45e2598da0b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:6454205f44c8b29a736489797e1c1d642a55e4005fed761fa1266f5b53158a7c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:fa9e2b9436fe6ba5b4003f6061e54911cd283cd6f1037f979f2070040b645296_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:78e659210f7b31df84f27ae6f4b74fabd9e408dca46c2fa402d01aac62181a1a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:882a82c950575baccf7ffbce4b793cee4a4e8da49233129b8ee72f74cf3b4a88_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:fa48c2e7597c45ed2641e73e21742ce45959caff31bd630fcbb9d6cdf59ae714_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:2e4f5c6f9d18b4d5f84f0f4f8ab1cec3cd859c78d0f4070a26014eee5698d5ed_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:d10de8348a6e5ba54647742410378047799b6d965500feafd26b0f9d47c5c98b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:b3c413709468bad8b7599f61c9dd307923eeec77631c2ccd0e4b06361f6a1859_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:ff42fa826b6f4af932a79141900432e17bee6baf1c2e6bcfa26b70ed3a4a1170_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:8b4c959dc37890a7e345894554527d7bec4e48322ccea1e9fc383c9596a397cb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:45728b640426c077f41a60947ea04078a35a83e7906354e2be6e0ab9f26bba08_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:108bf43b50e514f3761625f17f9edf790a3ee38deaa5eb3285121aaa677e9e0c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:bfe584af19f43128d265f31b66d313a716d59eeea1799dfe865d693a868588a6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:6d221f52fcace5b33bdd9516a4f96a824390e0c308d3d2635906631c133e4850_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:7489f4dbdd48aefb908dfb4638029b78311c1013752de58c970f84b2de5d0319_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:37bde285e8be538b98fe894405163ea3e136cfdfdef48608aa09978214f456e9_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:3c9f824443cd2d2f8e79b0d8be2e475b06c8c545edec6f30f8536a30e9226ff6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:7d995845565d55dad1e01a7f182ffd80735c01ac7a2ec979b3274be648219066_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:80926f5dc62ee2d05bd2b3e8ac7b2d8ac1d2ae516e514b25a6a527292cd657e7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:51ef0ab77ffe0b5ca9fd2f9acaec73e15eba65c764bbe2bf62b85479faeb6699_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:afc282d6de603c84aac2e3821879aa55293c4be2e5cb826c306a3ac4364f3dae_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +161 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:61b4941f76aeed8f65735643d96a6cd4a823018cb7ca40d6966dd098bc8dc284 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (6)