RHSA-2025:1824HighCVSS 8.2

Red Hat Security Advisory: RHODF-4.17-RHEL-9 security update

Published
February 25, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (5)

CVE-2023-44270 →CVE-2024-21528 →CVE-2024-45337 →CVE-2024-45338 →CVE-2025-0426 →

📋 Description

CVE-2023-44270 — PostCSS: Improper input validation in PostCSS CVE-2024-21528 — node-gettext: Prototype Pollution CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-0426 — k8s.io/kubernetes: kubelet: node denial of service via kubelet checkpoint API

🎯 Affected products106

  • RHODF 4.17 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:32836b65692d90a9785748674fb67e26c4f4240f2ef80c5142497fec897bf810_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:9320a7e194553147ecf600e0cf898c12ecdefb2aed3a5a8e27a3d09a47d4367d_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-operator-bundle@sha256:c50c2b8404d9165d4fad86af4c81b88f3f822c5680bb12ea7fe864118d594eb2_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:2fc2862c633ffb1cfa7e7ad293d3cfc008f14c04c7ce7696f554bbe66f8b848c_arm64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:bc0eecb61bc515564d8b31bc47c901d287e62662c66464ef6c8394e7b85df237_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:d31431f31116d18b758777b7b4ddf3462671dfaa803696d13f354ca6adfb3b92_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9-operator@sha256:fb34e43974dcdd9fa62856672a5281a6bf178366cd041fdb5a0e2a8bc3edb75e_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:3411316640144213b72b30a029112d4961627a116b4e71ac2bd36fe0c55f4128_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:393e15c21fced59cbaea52bdd9c1a8a8a62295ca3d15a73e5c3c169e2ea44a05_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/cephcsi-rhel9@sha256:954eb36266ebfb6da105834ff03def81d1b1f8dbe7b485c51f94377398faee2a_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:52a074b613c2180812a4680855292e793b13e7f92c4185f46f2e7c71bc35e1a1_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:5e3cf000f928322ef975a26ffa973475cf38848c987ddeef4da363f195af0662_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:7205aa94aad7eb1cc55026b01d710365a7648e1e6fb743b985d51c1d9b0477ec_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-core-rhel9@sha256:d34f251b0f3321ed91be851608cb93636af31367972ffebcb586eae311974f1d_arm64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:42858b32d4d522ba2f46eb006cbc2088c22fe68eb3ba2f5c5cdd54c1ba818ed3_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:739e1f5c0d51888212080fcd70fc3a6c8fb7bba76f24c84f9d7a7dc105adc094_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-operator-bundle@sha256:ffd51ec1be885a1cef74130ab4b56bda11443d863183372327e9d0bd5cb00ec2_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:073782d32cc734450e5a2619853d2af04dac8f335e2eb0b90a53c12c1bede270_arm64 as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:1e6dec76cce4c06ac1f00b1d75eaabb8a6535b1c6bdd092f0acb846c69fdbac0_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:6e0a13d9ec29cfe7617ff90d9a7dc8d02d74097f20e3d37fe423fff2e73d7271_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/mcg-rhel9-operator@sha256:87233d0505f309326d1b1c425c1e747dcd510a216ffa124af2cd46cd0103c529_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:6517bc1cfe325ef66becb1622f4552936000ed2b3b0ae122e912623190cda0cc_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:7480a543cf14a7a2109c84388e464521fafa377eafd3aeb5d3d778901ec63600_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-console-rhel9@sha256:bf400d628e6f3aa9c9211ddef6eda3b30e55b9578a4d41b981ccf5570da9ca81_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:93fb55817096e6d737bc724a1c8f5dc6f27b76213fd84d934fb91ae3470d12db_ppc64le as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:ce6d8d6c125887000f073d12e4854eabbe09e9a4084ae90e201718c289484df5_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-operator-bundle@sha256:d7f5b59c42baa647cffaa22f58dc1447f9bc33c8edf8fe16ca044c5f508051da_s390x as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:65f18b3a8c36f4fa946d15b36a8a0d677612323db6ea289b7abee82e7e9c5a43_amd64 as a component of RHODF 4.17 for RHEL 9
  • odf4/ocs-client-rhel9-operator@sha256:af21313ff0845363ba429dce97c244f9b6efe172a3684cfd677fd138d6526abc_arm64 as a component of RHODF 4.17 for RHEL 9
  • +76 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, disable the kubelet read-only port by setting `readOnlyPort: 0` in `/var/lib/kubelet/config.yaml` and restarting kubelet. Additionally, disable container checkpointing by setting `ContainerCheckpoint: false` under featureGates. If using CRI-O, ensure `enable_criu_support=false` is configured in `/etc/crio/crio.conf`.

🔗 References (8)