RHSA-2025:3780HighCVSS 7.8

Red Hat Security Advisory: OpenShift Container Platform 4.13.57 bug fix and security update

Published
April 17, 2025
Last Modified
August 25, 2026

🔗 CVE IDs covered (2)

CVE-2025-0624 →CVE-2025-24928 →

📋 Description

CVE-2025-0624 — grub2: net: Out-of-bounds write in grub_net_search_config_file() CVE-2025-24928 — libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2

🎯 Affected products194

  • Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:643fdd5d437c10e77faf1f61153a81dc544d486832f9744fb6791df48c1805af_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:0c1b95bffc927d710fa95eef45ea95a1edb412d10c119e091f4188c6f9120c89_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:277e9d8648b3859ef4d76eb4a9c96969eb11bd2f582cf409ee468e864d8629cc_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:4e79faa8016c730f7fd759c487c8d93f77729d0dbf18425964a9e32b6c021b8a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:ede6aafa4f5b35ba41802ea651860c0a80918924a7c4152923f4082539f39625_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/oc-mirror-plugin-rhel8@sha256:eb6981b4b42f4738a2f2c79be941d9853dbd0598e6dd80abdcda0ded171c47d6_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:b8acbe18dcd24b11a337d3dfd5337a956900a39cee88e480545e28b15355f22f_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:7f5382a8845ddd761fd000de71ee43d12d783ba74f7eee85be06e45f34da7162_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:128be20a193d34a743abf43676130c6f7f0e4892a69e8caddae4ecf0489e6483_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:9512e0b2faff97245b979ba7151b02cfae7c3d98b5c47d2a9f4dd6c8b79e9127_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:a9a07138290d1b09868cfdcb70f755121a8b8632581f3aa0b2c7beff0f1366a5_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:c32b16db0241e524b6c696f850e8f38cc9122eca86cdb247dc4a6bfc1a492d88_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:83d8d3e880424ef1fb910e68805e1aa644b8c37e516eabc4855f798183c834a4_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:34d9170c86cd3044a74b6f7198574f73061930d70c6efe4020f93e2879a3d387_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-alibaba-machine-controllers-rhel8@sha256:e2a22b6498ae574e9d142c060779a3c58eb5a763255b69b285d8a23fc5e3faff_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:84f17d46ab7282f1954b4ad7a848edaf2f1f69fa956da921264098e266d04b60_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:38bb62fcb0c0558df65be7feb57edaca48a8e9f11a33dff3dbc622cf4ecd1287_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:33d316353e1587a4e939c07cb5684aaa8929920a4864322e1f18325230528007_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:e71b3b86c5757c1185c6b48d0cad4957799591ae44e811b88628b252e27a4ef3_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:ca32357582d64c3e11cb64b082e664c917b9e59c913d19db7f1c63f6afac15ee_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:57ec0b9714e091227c4d8456b105efba3efa05faf3464148a1952f2a01a8f58f_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:56e67e9673962e96344615b34eb5213c356aa7b897bdc35e998595adcee15ebc_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-azure-cloud-node-manager-rhel8@sha256:8ee2dea64c94eb4ac9bee6e4edd77d36d746a59bc4d1d26e9e493d5b9c1cf310_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:d43762ddee2bc3a68763a17c95623585b138508a5023f9a842467fad6d81101d_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:bbc312625e5164ffc7cd3f98735fc0ac50e4b13bd09746181113bc87de563a02_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-azure-disk-csi-driver-rhel8@sha256:257308dd4915b708a67d2ed256965da1043591b0908806051efaf5f6cdb8c6c6_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:2388a3d130b71626aff2da0378ad375acd5f5403611c69fa53b82ff19df0c4fd_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-azure-file-csi-driver-rhel8@sha256:6384eb6b587729ba25c8e12a1c0a7aee8a05c5bfe07df1f46f8de3ea7f08f8f2_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-baremetal-installer-rhel8@sha256:96ec09ba8dbe5256911e2244bdb6027a1bca389a7ba7680edbf28c272a8579d1_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • +164 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:9d16c0afca73d20e79bc190e318a305f466a571fab05766dae6b597957ec0ebf All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (8)