RHSA-2025:4723MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.17.29 bug fix and security update

Published
May 15, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (2)

CVE-2024-7128 →CVE-2025-27144 →

📋 Description

CVE-2024-7128 — openshift-console: Unauthenticated Data Exposure CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service

🎯 Affected products101

  • Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:0bdc4c743bdf96992559ffcd80499cd5cfb6f9fccab78a11422f9e186d5f160a_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:4613e2c44e06277707fef62fad7990d981c10f67b31843109bb0b91a97293aff_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:5cad7bfdde394d88ec2cf8885f2ca06bc99523ce25f7fe71e75531c60aac6b54_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:edb34a91ed06cc7c50cabbcb1f4af835a1e61db67c9b23f6a348d99abdb020dd_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:51ef97b35aed0367033672b8b3d677e6248a00a3515bef25974cef55735bcf0c_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:57c0349fe4f092c63c4d0ae534eb5facbb9a61191c1ac8562cdcc02cdd356cfc_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:8d84f99986ac12d4c45819f432ec352243fead1d43dfa3c8aa81fdb971c9556a_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:c399bfb3c81c3b87ae5a8c24d48adc24b83127b2a4d03fceb962baee8695ce30_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:3563b0f125fbd477626ba59ebe77542c002b842fee06d3fef3d282bf1fd3c6bf_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:3e54f4b01817a0c858dfdedca55f6db897110fed90a0fea69d22fa1ebb263204_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:d8446a425edae9751e9eb2df701ce124b9a1b3a9745c55e6eafc8adb3133553a_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/network-tools-rhel9@sha256:d9835f4c61e8501eba4f3764a217815110543ef470c41272b6d6e3394d52c4d4_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:08308378b0fa743f862919ab525bfe3b604f160253e8900dccd081293b18c1ff_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:61bcda682b29ac2a7b432c74c317c43ffac803ae83d722ab183863adb196b9e1_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:860fb068b4b2bfdfdb925dbb198a51db9ae431ed57583db8611aeef229dffc99_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-csr-approver-rhel9@sha256:e9515e5119296621b4fbe68652ef046304d7b31a98a6a34411ad6fe89e9ad9a2_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:03b45d9571be68a7576101c180ebed9bdb0d2fde64b2e7e438b705b8bf1e461d_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:196e5b836f6b2607e7197867b50bf5d6ba50453c0270136c917cd16f062ff3a1_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:64d8d40f2f88878596744f4052df33fd443a2a94c0db7c82504a0fc6f24ffa85_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:ad30ce885f91402676b2c94a4fc94e937ded6fa288d3ec3777623c728acf2799_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:150f2161ca342b653d2183a90f94fb56184846356f5ff8790a839db70e907a78_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:166601b837e3f400b5a068ea7af4b81c2a98110c9cba45fb6c3b227754fc27a2_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:7e27436ccbc1cea35b409e711407aa369555143ab19b922703c845a4537683dd_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-agent-installer-orchestrator-rhel9@sha256:a4a31d9b7d529a2d6a91f51d200b74eca014154be8dd38383ae81aabff4789c8_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-baremetal-installer-rhel9@sha256:2199a9500e19b27cf430af139886c120860bf7005b4e818dbd7f1442e158e793_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-baremetal-installer-rhel9@sha256:7dcfebb7ccf11001a93ab5756276aaac670d329972f59b2704f5c2b0a948c4ca_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-baremetal-installer-rhel9@sha256:9478c0eb3d2164152a4f3753735e781aebd76b6e2e70039742643e85aa0f6989_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-baremetal-installer-rhel9@sha256:d9645efc082049c45690974422e41162f912db64eff22f7f0dbdb82f65d54a65_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:3068acab81518c7cb7711317f29c287ae67a0dd3c20a81daf56a7f89cdcbf3b4_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • +71 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:df00d64554b9b5d860273f938e0ff3b0c4a7af8356fbd103658ebe6fa2a830c8 (For s390x architecture) The image digest is sha256:9e8682c84e3424e048ed2469279e675debf4b929bfa81c29b702c8513c6c0eee (For ppc64le architecture) The image digest is sha256:4c231311d8d0e4cd794831b96df606b7032943c29e598ec676d4bb41c2432fb3 (For aarch64 architecture) The image digest is sha256:33b7e1a9f973a249de320a42680c0c8de96b77b44360c02e597efeb721153213 All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.

🔗 References (11)