RHSA-2025:19003HighCVSS 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.20.1 bug fix and security update

Published
October 30, 2025
Last Modified
August 17, 2026

🔗 CVE IDs covered (2)

CVE-2024-48910 →CVE-2025-22874 →

📋 Description

CVE-2024-48910 — dompurify: DOMPurify vulnerable to tampering by prototype pollution CVE-2025-22874 — crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:1bc0d71b33292965411177fec464e2062363bf7730fe7e9082f8612e001828bc_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:2c316c68a0fcb212b604c3f1e10524029de0c7ad43fb6abed4b9c737a8bcc480_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c333e820e90f5378d0aaa12ce517097c2dde4abf44109480feb2002277c71286_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:fb242cb4f4784e2a46d5e625f5c71de8ed75ed28ba3eb56f74c488509e58c643_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:10ddcf8bc12de2a84203dfbb61fef212658a26dc64b011f4a2496f6a8ab9a631_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:1795b28cfa67accfcc2b3877cc17e115912350e5a9e39cabc0d9bdcd52cfac68_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:d7a05a21265186fadd72a08fee2e88e56525f01876e202c330ea61d466bb4513_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:e00315133f105d6ea2a9e4004775731043ae747ad1301c6b5f4b2feada9ca70f_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0a3545ac9c444cf9fea9125589c0686bceb261ea8a55a7f2323843730f446c10_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0a809ceac60fe1ebf167c0af99ec6ea287bf7e26b2727e49788fd18bb5d218ae_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:5290d473df95556164fe79db14bb2468f19df1cd7e87cdeaba1745ea9bfc8252_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:84323787c49fbb5f9f90feb7076d5859668998fb1d08f6220d90f676e165137a_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:1090d41a90b7aadcf67a137bc37fbfc54d5fc08cf8d96d41f7d88e929a179a3a_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:371963d4ea9a04f2977c2875b2a7f1d3672644abf4576d08af43a8bb11a21c31_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:784c62bc5457b8b834e2a3b1fa1861c1c090e5abb969acb5991a9b7ffccabdcb_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ad4cbc844c1049b56def008f0c20ec2e70611a41cab762de159123eabca52bc7_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:73471e2d86b6b9f7d31d66caeb67c203dc73529724288113702cd7249eebf9d2_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:83a8564bc6b1eb20322171873cc55aac0f2668fabc8099e783dab6a77a1e9790_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:91997a073272252cac9cd31915ec74217637c55d1abc725107c6eb677ddddc9b_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:d6dc9460da81132de6719fd8f4aed42a7334947e369f051330d3356678d65174_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:8e3daf7ed2f552d4b7636fea1359d785b5601aa61c56a35516ef9a514fed180e_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:92fd183188bc5b645947a7741214ec37f9fd40004c4a03364b0784bc563c0143_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d1db742547d942190e19210b8ee3fd09d5772f69686bbcde1e09f12fc0fcc222_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:f862b65628a87c59f7ebec42b72ac25e543dca403a2ab1d8280ef5413f42e97c_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:1eece979ac996f5632b232d018da08dd7e6ba74784863d8a108e3d7c4a071251_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:27f7ff9294658b2ae50cef174625438d4a6515bb18cc7bdd408e1f53ad77035f_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:4396f6b4629ba45fe23c13c91aaa64427e957b15841bc65c84537763f00bcbe0_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:476069657f640a4cf5687f376454521488d1320f5510adae058b55a693a9985f_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:305baa5888ac343e44bc1605701202609a57f7496cf9e57975bb0354b0b3fdfd_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:cbde13fe6ed4db88796be201fbdb2bbb63df5763ae038a9eb20bc793d5740416 (For s390x architecture) The image digest is sha256:7ebf9b89942c0619685427117c5dcb9fc3ea3ce7fc48b878a37d620391332d5e (For ppc64le architecture) The image digest is sha256:6cdcf883799d2f97a7df564d732ea6226bed846bfd62cab55f224dbee02796f2 (For aarch64 architecture) The image digest is sha256:29326919cd265074e9aaf16a57b817d3430d0504ab4ef96a8d9b273ee666f508 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (5)