RHSA-2025:9562HighCVSS 8.5

Red Hat Security Advisory: OpenShift Container Platform 4.20.0 bug fix and security update

Published
October 21, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (4)

CVE-2024-45339 →CVE-2024-45497 →CVE-2025-22869 →CVE-2025-53547 →

📋 Description

CVE-2024-45339 — github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog CVE-2024-45497 — openshift-api: openshift-controller-manager/build: Build Process in OpenShift Allows Overwriting of Node Pull Credentials CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-53547 — helm.sh/helm/v3: Helm Chart Code Execution

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:1131fcfdec26956c87228a11b3846c23216bb29ac71644bdc6b1e0522ab78d29_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:1c90dfe31bb71ea22d9b1edfece83a67126fcdeb802f8c73cfb669f82afa7daf_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:3cc41e7c3d6276e7799481050fa647dc65434e0ffdb540f76ad5a7de76d647aa_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:47468c068ead377acc315ed2404dce84981aa34d28c2edde07e909521dcfbb23_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:0a47c1b24f1e1213a9bf0cf5556784f95c91324e4096e31f6d8fd6f0e1a3312e_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:544d050791bfae94aa53db2c08d0d4df279a637f18cf22a1935621264e569f52_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:5a153a6e0e7823dd12484010acac6b71369086b0aff0176447ec2993518f0ab5_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:baf1d18acef8e94fd852f99cbcb5c72a647827cb6069ccffe57697089d2327c8_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:71095fb59f9b7da72951994204e81f27c5ccf8501e3d2e0a2ccfd94c7595767c_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:7d45164233e7acbb0e615048680f509b10d5a2da14520324ee3f334d8870a36b_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:993e240a38dd9cc91a34cb9642e5231a44fbdb039d4eb6dfccc0fcb81ea28354_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:bf39943eb6ddcc12db70a63d79d343e1ecf0ab4da63f0ec5542f152766809540_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:55ed2b3b8d62edb3fbb8e472aeab31f5d07985c57df63f2bce68f9dca114cbea_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:9466c0205433d70d31ece712176059b5dcc648067ad90fc29b8c0364ece197b0_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:adb5064d6960bbc8197253a8b1ddf925f2c60ff37fcb7b1c9625b25f223f1c46_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:eef96becdf360171446ce10368557d23d46f1f15daa19e220c5fd0ae94989253_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:0f27e51b516d1d42223506c4b1aaa35e42619ea47ae54506ab2009d7aeae1c3c_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:83a441f7bdaad08b6a669ec55b84f9ef3278b688bb081800650f4f5a03260801_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:9db7bdd361d248e5293548e40f29ca141ae198f67fe9bc7f97668054edbef1f1_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f4765808695a3cdf97a941d181a347a741589f32315e334b681cd79388415fb0_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:17eec2fadafa42437077157690567e89c6fc58fd18e8ddc1d7bfb6daf70ad36f_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5df01dcd8f993d12bf2bd595479736e00d1790dc36a84c96b1e297b767b27b3a_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:b93a77bcaaf518f24edfa5b36ccdcb17577adb33f9ba5a5fe8dc45af04f979b1_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:f663cb063365339c8fd416679f6777cfc4aa23030bef0352105c3eb508610352_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9d13ccad936fb62ee3de6f9f9db92c972de7189188736d730f2e37b8c56c725d_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b55dc28b2f717af2e5a76e029b596396c476ab6a55e64a1540da343b26f1e0bb_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ddb102281300523fc0cd683fc118149554b74b16c0857df0234a6f1030b00d23_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e90becf264c54e3d0518fa38fb07fe8ffdbbe9660a4759e52e3fc0002b5c3f06_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:74ea1f7256c2c9d06d4e57d531a22e5b7b1162bc2b93811d2488330360f3fcb9_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:d1dc76522d1e235b97675b28e977cb8c452f47d39c0eb519cde02114925f91d2 (For s390x architecture) The image digest is sha256:bb2b07ca992b8c976341c145ccdcefbd57e946a590efaa5e10d60fc5a2cbe503 (For ppc64le architecture) The image digest is sha256:678369ac0a189674b3d9f5779ee7042b39e625ee580579ec302d8899f8ddc613 (For aarch64 architecture) The image digest is sha256:791079aeb081a9193cec139ba4dccbafbfc9437b6e5e39d70225b0e6d2f51b34 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers.

🔗 References (7)