RHSA-2025:4012HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.17.26 bug fix and security update

Published
April 23, 2025
Last Modified
September 2, 2026

🔗 CVE IDs covered (3)

CVE-2024-53150 →CVE-2025-22869 →CVE-2025-30204 →

📋 Description

CVE-2024-53150 — kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products100

  • Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:0867d11c4679d28f4131a2161da5d809be608256255fc4e987dc083edcc3a726_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:2f8580343ecc25e356ecebbc874edd638feb245f046711aedc92f262e278137e_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:cf4bb912874243ef17f21e792e9834eaeebcfaf177198fe39ac6f313a4fbb7d0_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:fca2a21602ec267e60095e91df322f79da1edfdef08f590964fe9357394dc0e2_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:5ffc0ffe0c2768f89b935a7fba5e9d2e0a27a6cc456e1204dc39554dc341a6f8_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:651ea9fab54113169358ed3117dc93e0cc3eeec6adedc2a45a02fa9df2b35f1f_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:de416e98c9ddfd00883626e0150fa6aeb5493889ec0601fdbdb040e2a6e94590_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:f3ef182211e7278f7ee750a8127ed54f73ded49fb4e3b74be658c96d5c37b219_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:583da8c35cc5872d7160860cc424eaaa0204f532dc4fecf8526c8684c4b33987_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:5c0bf077689bf90170a71c88805a6c19cfcd22cd7482a52ec4b3b55f27b2fea0_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:9e5f42f16ce95c2f8956272bd3ad3ca2067fed53ce7a28f288a3418ed1f94cce_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:a2fa6351008535b8582ad82272cf624f16e33e4a33ac3461955e28aca54c252a_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:13e745e680456e63b5af4d9fc987f65b5a6118259d1fb2ccb2850489608be6ca_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:98ece001bdb8e38cb5ce9b054f90970c0a6c31944d4bde6f4bbee1ff3d679573_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:db407fac949956b041bf7c9a3b073800171430653dbf55783b836d2525b87cfe_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:eb222320e9188610fdb195ba3ef6272c41125e3e079371f0d8b81ff9f895b67f_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:065141adca25c43adcb6c191ca8f15df3fe13548c95ad68244d44a260ac53b6a_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:46157310adc8d05277f438c292d4efc788a4b30037d598cec4d4102673883196_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:75209f1a5788ec0e69f45dc22de89b2fc278a6871b842c5ea424c7459756adba_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:f9b1d3b0f62ca796cb90d62815dedb67f3d81445cf1dd0d41e61e8b4e1aac6da_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:27f25906472135420025e2b5f4f32c5b7dcb448636f419e48d8654fac3df3e0c_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:80311a541a2f0beb1ec9ef3070415c182e06fa70c054d1da9a6141845b3a1e72_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:acb530b1b24fa51c4c451abcfbf30d6a5fa439d5bc3911778598a86608e49eb4_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:ae637dca8328ba8dfd4c2957866bafe3fb5c07137b295a380553716b2ce830a1_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:2e17063bcb619321e576db2fe1dd3693d6f31d1df7de6827bb71ddbeb954b9a2_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:4921e22221b7428889f3146a940c2c74d74ea304cc89b262319fc84b8a57f0d1_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:cc2e498e90dd068d637f18283317a4bf77eb0a1a9aedb521ea7c7eda8f02a396_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:f6b37c974d3a873189225eb74277bcc69acdbaa061f4ffd759dacd2c6917f652_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-baremetal-installer-rhel9@sha256:0e641f7debb1e018070e9fdd488731cbe89b0bc1fe380a163d277f738c9c8ed7_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • +70 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:a659df5d19dcdbc7fd9ede710b213cf5b269c31612d1b5ae3d01a8e5e5619bfc (For s390x architecture) The image digest is sha256:6a672395f38e3c2cab7603ff0a47f8910fbcfd36df8c065f17ef493740dae9fe (For ppc64le architecture) The image digest is sha256:b2dab96379380102a1bc3dfcca3844d754b12ba80a4532ae1e25eb46f14c9b6b (For aarch64 architecture) The image digest is sha256:7ebda0cff02ca44d6fe8b8b849846b25d978efa249c6f273ed8e54efbb799ea6 All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, prevent module snd-usb-audio from being loaded. As the snd_usb_audio module will be auto-loaded when a usb device is hot plugged, the module can be prevented by loading with the following instructions: # echo "install snd_usb_audio /bin/true" >> /etc/modprobe.d/disable-snd-usb-audio.conf The system will need to be restarted if the modules are loaded. In most circumstances, the sound kernel modules will be unable to be unloaded while any programs are active and the device are in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (15)