RHSA-2025:4204HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.17.27 bug fix and security update

Published
April 30, 2025
Last Modified
August 26, 2026

🔗 CVE IDs covered (2)

CVE-2025-30204 →CVE-2024-24786 →

📋 Description

CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products111

  • Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:25ee76b33d7189324a3958f1dfa5f1dcb05af9165f66b887bd78411aa1eb50ac_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:5bb600e584079a4a1238c0c59460ae0801869d1fa045360cc631498dbf9fa994_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:76b9af62cae35e24e90fab27b1eed8830d2b9077bcf4aa238cd52fefec1dc6b4_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:c0469002f7ea21a00b1514b607f63dc289e66e14cd35aa756f5ec2e545aecf4c_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:5f7b8a6b83a87bc254977899e63a63a43afe1150f752f0ea0374d5d5f0c1be20_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:d38a5ba1ff7f1e94d1587c437ee5552b826c44aa638e6bd4ba947f9defe1d7d7_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:d4f7b5c9712454f6645b6221e21477fa04d86bb6541be17d9982d3cac2fd7b03_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:fb762d60a6c87e9386fc84a66252082e85cae9c2f58e1b615629ff81ab270b12_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:4d713066d60f5022f0cab45c9a95885f01d75f0f7a3c6d57cae5f8f0ce8f81ec_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:84c81eff8f12917e7d778db9dca3205f5d5165ddd740c650a5906fab85d44f2e_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:c5c4446a1c7341895992f85462872aa4d5692460eb0770b1bbf8a0d8f2d4a84a_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:c951f4b8b0921b16e8f37f55b9bf3f6e6bb2da4056063c5a417017cffebca1a7_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/openshift-route-controller-manager-rhel9@sha256:1f1f1dd9b78d9dcc9aaf7b4b854ece1b51894667bd67d1c5ffb8e042bfd31bd0_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/openshift-route-controller-manager-rhel9@sha256:7582af3d9e3fa3bf10a66581bf0ff6788a4efb76c2bb3ccef8cb8a97159cb5ae_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/openshift-route-controller-manager-rhel9@sha256:e6093193df2059e175ab93f8bb9ad838df61c63194a9301bb144e98a576f5eae_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/openshift-route-controller-manager-rhel9@sha256:e8a4875b729fb26117eb2c1aa80e541a0f22ef12528bb8e90d655e022f153463_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:6588863fa842256355a795a273035ccbf254ab9db1a1f32d7717ff2d583a7218_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:913dc3d80b44fb919cde73f6d59e7c20a859b31e70a2a0815c2271f554f39a46_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:aba4bedddff41f35f7900ff6f4d859e476ba7cae8a80a357e3bde2109df2e181_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-api-server-rhel9@sha256:dbe162cf5b28e5b828d6d1576443986a9f2a9e6f86b4d4db2c949713322570a8_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:17a25a4d52c6467640fd37a513e6e00f9d2423db94d7dd84dc6af412ec98e373_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:44df45a4cada98cc00d219e3da0f5eac536d4ec6a413d73fa774b19271330cb5_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:ee25f07cb35adf60626709a2ee8c7e34777b4dfee09f1abd7214c0760bddb78d_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:f824b38f1d8dd44e1b23be2a6e98e08720c56d763defac4267e5868d360cd5f2_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-utils-rhel9@sha256:320f1f5e7c0f8b871c7963381508652747efacf9e0003f66838c46c5963e8b8b_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-utils-rhel9@sha256:a797fa3d95218d4c9b62cdfb4a778221438ac1d22899cfbba2fce34b0b3cbba5_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-utils-rhel9@sha256:c8c13e98bcb67fb077cc5b9516cc1cc9aca33e0eeccbf11d8d65089605e93abe_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-utils-rhel9@sha256:e3097ccc2050bbad9022a19e37ef2941a59806f355b23ef9e914b4e4ebb445d6_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-baremetal-installer-rhel9@sha256:3523fe5d514315044d97a1b13396c63a9be9c72a17a7272feabccb3aba99fb21_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • +81 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:f225d0f0fd7d4509ed00e82f11c871731ee04aecff7d924f820ac6dba7c7b346 (For s390x architecture) The image digest is sha256:8f1c45f2a34934ef36b07c46018617870622fd00d0b4e83ad608de51a1c45c73 (For ppc64le architecture) The image digest is sha256:5265ef61f4401e7e81662c522e36dbf2c3a92d54ea462df4df7357967b0fd4ae (For aarch64 architecture) The image digest is sha256:9efbae9de423fdc94e8f8cd757445890939f08fd41203865febd6e31e0813b56 All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (17)