RHSA-2025:2454HighCVSS 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.15.47 bug fix and security update

Published
March 13, 2025
Last Modified
November 4, 2026

🔗 CVE IDs covered (5)

CVE-2024-9675 →CVE-2024-9676 →CVE-2024-11187 →CVE-2024-11218 →CVE-2024-50302 →

📋 Description

CVE-2024-9675 — buildah: Buildah allows arbitrary directory mount CVE-2024-9676 — Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) CVE-2024-11187 — bind: bind9: Many records in the additional section cause CPU exhaustion CVE-2024-11218 — podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile CVE-2024-50302 — kernel: HID: core: zero-initialize the report buffer

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:071059c27d79d1b78f1b922049a1f69e6be887e09b7e8b7cf65f4e5917e678bd_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:4987b7a5c1902ca762ddc19bd134288a8f3c8de92d39e65fb882fa572d66e8cd_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:6b21d9a6e299525bc71e32516c1289b9df0d1802219103289c746d550c4b676f_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:cd102736c5318115b795051c3e0147e5b43e028a35d28867e795bc40be4e3e66_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:3f1c946d9adbff7cc5215be88139a0b31f4acee6d0711069a0bd1603e9b77bca_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:83725cf4c2840e63e1a9e084ef800d81ccece764fca62efeaaf4964339b10407_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:abdcd1b312b8da572f129bcb27f999173e26f2b1e0e01a898d988d9cfa3a1c77_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:af90181f0af929c105ed1a2ed8505da2e8f1652055fcb5cb1ffd69a6599ec366_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:1326a7693be845eee15bb867805e2300a002488255cad93aa196f71f8700dc31_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:8fdeb570a779e26639c19186371fa2e09a3ef6a1d197cb47a9e84d4a9fe06cee_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:a5abfd5e15efe23c3f13d5eaf57007c44fbde2bfbc7212ad66f48ae09b51d017_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:b0c8cb20745f721be125304aa1330b61151890c9faec3ebe399890aa7f156cc0_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:05376e92bcf221735ff96b4c98e36221f83412e0021d19a21205b5790287de79_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:0c7b1f4fc152331cd354129146d556604e81cce63a2c25675adf84d436494397_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:4c96d49e77f36297c1c792af5390efbcdf40a80d4a1fbb0dddcf27754f186cd3_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:f9c078c4caef68e091e7d5e39d77b624cec7368fe44ed9cc528a5c0af6664de7_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:21f737611072296fd1de8027abbd3846b967398fab0ee0fd5520b300355d768a_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:5fd6eeb31d4106ebc5388dc75c6467ba76c142275503fb0c7b0c9c7ace2749e3_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:9d93497cc3e3c340f24fefe56000d621cb3c2c7412ac52a14dfa7634e201fd82_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:b4f6152109a0c1f0262132b727aac1adb825f7c4863875a8a26164eb8086a311_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:094793687dbbf237bb370a2e9cdf2e7aa69f2c0685f8b840ad0a8d0bd62c2a03_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:1f2e80e27b9355165d44334b407fc6f00284b479baf1173328d0901ab22a98db_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:547cd62a8ea3d4613e1c87768f904f6d3be254dc194a988e1e30be625a42bae4_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:8466032bb27cb7ef2fdaac881e9eb8c2096b21cdd9d0e6b02735c631f7583106_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:0279afef8c6573055c3c06e75371ef79ca985be9be5c15685def84b8a6d3c1b0_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:16707db82f4e927b5ef4d0fa6b3925d91c7c82a5bbdd7e3f6b5853fa2d215300_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:437ed7ea09c950c1dac4fffce6421ea79392fdf5c7cfd31c22b5ebfe1924507e_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:4e7389b911acca279f30a081184cc2ee66c85308b486939b0a1f2b47d912f006_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/openshift-route-controller-manager-rhel8@sha256:499cba913748f3b963332feaf947e43b88588d821c162897faea17378815c296_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:5b4a7992e54844ee8614476993919b7cd2d7d21dd3a48daaacf7a9c4f17bece6 (For s390x architecture) The image digest is sha256:022a3666b20cb12d5b907fb0025ee2ca0101b632dd8bc7851746f3fd409c3559 (For ppc64le architecture) The image digest is sha256:28a99ce4052c87e3b88ca80da191a61f058e3b8735b7437b6c4b0ffb9e360371 (For aarch64 architecture) The image digest is sha256:0ecfd307bd4e9ac0b218ea79f419cb78d7e88ead502e33724aa91b8ab041f497 All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Users can set the option `minimal-responses yes;`in the configuration file located at `/etc/named.conf`to mitigate this vulnerability. Workaround: Mandatory access controls should limit the access of the process performing the build, on systems where they are enabled. SELinux enforces strict access controls by confining the build process (e.g., Podman) to specific domains like container_t. This prevents unauthorized access to sensitive host files and directories, even if a malicious Containerfile tries to exploit the --mount flag.

🔗 References (19)