RHSA-2025:7702HighCVSS 7.8

Red Hat Security Advisory: OpenShift Container Platform 4.14.52 bug fix and security update

Published
May 21, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (6)

CVE-2022-49043 →CVE-2024-55549 →CVE-2025-0624 →CVE-2025-22869 →CVE-2025-24855 →CVE-2025-30204 →

📋 Description

CVE-2022-49043 — libxml: use-after-free in xmlXIncludeAddNode CVE-2024-55549 — libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) CVE-2025-0624 — grub2: net: Out-of-bounds write in grub_net_search_config_file() CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-24855 — libxslt: Use-After-Free in libxslt numbers.c CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products122

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:14427066f483a8af3d6c82cc7032b5ecc3bc9b0d199853fc92b50ab51000e14f_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:2f1b3b0f3bb872c05834cd825360062a90d9f6270e4e549e7e4ce7bd581b0950_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:57a2ca2abdd05644be7cf13e3f3cb3a847b775477f0dd665d3900035470b5774_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:bfa485e00e521a01ea1b5b5a3e3ef1ccfc5f4aca16c23db27059a7b6c7c0f818_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:0400e3a56ac366267783941486eaa58970f2c27fa669c9eb325a290583320c13_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:380748fef1256dfba9ac9e35ecce9af5680bcb2598893c7795c3763bc4352a1a_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:96cd8144ed4c2cc0c9ce31d451f3dad354f409588d83f44fff00b99d6cb01379_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:b0b3665c4a0f736471c5d01f9a9c5eb1189c2fd0857c858d4d606010a5382a28_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:63f035ff7e1c2a06acc9ad214d22bee3a6b84a6f507e91bd77e0e53a2048e0a9_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:8dfb2b50dcc5a0262ea022d1fb3a035ae827e0f5261ed4b70a06d9d514ac6b08_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:9f5a8f64e49b7178ad94a1afac240c140711486327925980405e640b1b25025c_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:c779577dd69cec9bc5396ffc65678d868f9dca39b9c16370ff0372b4d3632de8_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:1f979c26809ab94aaaa7b68ece60c10bfb6d46428c70c7ca2b5a79ada7616419_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:29248bf021b6309f9f29d79e65d148ce35e4d6d6c7a4cebd406a798deb55b621_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:997fc015dd43b395972d02afc23de0f2e6b67c00cde8c7f3f656c8a35212e069_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:c2dfbaacd442f76773b3b4718d8a6d705459df75bf8c25b0e4a2632cfd47a18e_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:0d5eb1083a40cd612f4afef5255c541f4e8d3312b4e1ec3c44a7279d364b177b_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:1643f467e27bf0ce87c2e31b716c59bb6afb8c6efc317043af00d16e610b1631_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:422d4bdfdbb11f440f8df6524007261012409a43ed1989fd7e583b9756a4159a_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:f530c74a9209196f24686e6130b89e9f9c7ad2eb0c9df1148d04240047d3492b_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:4a3f096cf5cc08d1183d2b94a58157fc22c1ca9685c0bcbcb6a4312a492038eb_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:8a38c6e3bfc986cebc96ef39ee26aa9cc968ddfa08abf4dce84f465f25757111_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:976e98c2a6d8fee45db3e8b25561ed7154ab10b0c6cf07283356c1b5aff09fce_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:fdfecfe48be2d425dfa4840b56da331fa44b22273d8dafd6d357943418d50fe7_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:2c33cf18cb06787ea4c13364516b401cb23460237f03c8af80babbf29459abe9_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:b054b3905eda183b54d6ea427b9678120cac863d762a82463a1e5024d39eb9a3_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:cd1ce337c69728e17259e35bb7fe06ac7bd43480bfdb61074e63c12a21971677_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:effe4e27fc072a98156d562e3e746c0560b5a7dea7023200f64f5c156d7fce9d_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-node-tuning-operator@sha256:064c74622e4c04aef74f1b753b338e741bb686c3885684138fe29c722da85efd_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • +92 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/ You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:66bd4e160209b4e7add5514498c4889812b76fa2786d1219d7d2152eea1b4f1c (For s390x architecture) The image digest is sha256:9a56729c25596d90c228f04d5e4b5080a3921a325e0c768da51b81b6a032cf07 (For ppc64le architecture) The image digest is sha256:078d5b2c3ce7ed409c454c01113e6171a8852f434069c1f8565e4a310b8e00b5 (For aarch64 architecture) The image digest is sha256:b1e60833e9535efa25a4e42efe461e6c0c9b7fcea4a499428bdee7577884f0cf All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (20)