RHSA-2025:19890HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.20.3 bug fix and security update

Published
November 11, 2025
Last Modified
September 5, 2026

🔗 CVE IDs covered (1)

CVE-2025-22874 →

📋 Description

CVE-2025-22874 — crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509

🎯 Affected products163

  • Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:02cb7f1c7965a32143b22134f2a3abbdad584893711f452fe78effa8390dc0b4_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5e865075bea9a39c7f0fe503e22f33494740b802631ba8eb43fd31ad0bbd322a_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:8e594eeef24b51e7ee1980e690e1234922746b938fd46a9338d312b9688a39e3_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e770cc0b5488b1faba6f82783bd8d5d761f4aab7e61992c25726bb37f2304ebd_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:33734a45fadad7fcd7f9412abea3a491e9031d488ef4665614c0754882fd73e2_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:49c166366748c673da7f43d0727684afef21af58b86c51b440897ee44003b687_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9d2898d0bd79436eb6abfae34a52b184a83349e71cfa1729ee45e22a8817b18e_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ed5d974f640be6d5694b69e78aa4262384ad0f700785f472ca39547f5ffb4f57_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/frr-rhel9@sha256:1701bdfb1f1fcf6176d07bb276a6ffb6e1986b9013e3eeb62c41f5be70baf813_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/frr-rhel9@sha256:1a6f8d27572cc549ae1c30cb1ef95cf3acca39a9eaf5bff9559999e8b83859ca_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/frr-rhel9@sha256:37322ccd3bea46c564beab6179b7586d3b5bb1d88a6713f4a64ed272b7cb3b46_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/frr-rhel9@sha256:fb8054741e2e31e4fe1d7603aa5b59489db89f5b39b4cf2617929dd01b62d631_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:634e4a6e6aadd2e105bb48ace9c3cdcc7c7982b7b24164531b4da094a6fdd2d9_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:96c43d2731064af8ecb61f8becae4dbf0dfd28171efea26d661bf9dfdf342246_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:b955f88b45703072354c90428783c90057e724abeeb2e19b4477c8a79b8f994f_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:ccdfd91cf082131083f77c66160ddb4f78f60465444d6ba63dfd7c89bea2fd48_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:25817b93dfab9fc49e5e94f0e8b9549c46b0b9cd3deb407329fff4a071b780ab_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:3163fbb592d3a4ec7a0c96f30004537b7f7b662356207ba1399dc3623d25a783_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:6ff34456c184f0bec20c8c232b49f71f6af2216a58fa7d60e29a5db1265ac64f_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:e6a7e327f8db5c910b6799ca480b0d1f41a4300d4c7c197eeebbdca3fc4c04b7_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:2697bb02e9530fcda8c0beb540cbb833cded4077f66b42a54f07b741e2859cac_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:c63169879e2ce1a9314a7b8fb12c606845a8901d9c288842d42a505197935645_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:d8aa03c18a66530f3351ad016bc4f4dc644f3272ccc5a447b9ec4464b5d17b56_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:de5a6b9ca968b998353c47d922b462542bb35dc7986964d7e8483742eb92dc8e_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:3099b986c9b732a5ddc9f4b07a9b52bdfe98f17fa3d8de37030f7eecb50fa7f8_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:441af724c156990103c112bd7190e632f25f3e8e3817d6b33b81eb6e8510165f_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:4d3dd6c542fc8f81703f69472722c6b7b300efce59c56a5a32b72a49a2f9d516_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:51cb88fdbd7bda166d3b92df32e6a561ed23c89ebd1c7cbf4881909a20146aba_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9@sha256:12ec916811a57d307391745a773febc1ecf865dfe568cb945de36a6fc5eeb90a_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • +133 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:24da924c84a1dfa28525f85525356cf1ac4fbe23faec7c66d1890e0b3bcba7a0 (For s390x architecture) The image digest is sha256:af6430d3149e5532af8aa51ed5810b47cb5b6afef9f805f12bc26b92321316bb (For ppc64le architecture) The image digest is sha256:fb3aaccdcb11bda4391827bd8578385bf331d5fa53d611edffcb52cdb8f2ed06 (For aarch64 architecture) The image digest is sha256:9c9e302e2eca08357d917e315a54dbc96c2546a6de22e3ba74bce1abca6eaf23 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

🔗 References (4)