RHSA-2026:2984HighCVSS 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.21.3 bug fix and security update

Published
February 24, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2025-13465 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions

🎯 Affected products86

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0f85db04843dd73811c3130b4da0917a4b46b3c9b941204bc402a95db4c70dab_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:37525c5860399a95017ce1c79b084e3cc06f2df5b4873d2fffc7de608c9bf9be_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:c8a953f6b8b1aae24e2b99d1d8e03769462b3e420c585ace69019c460384a911_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e7cbf02692c63c7ae9093de2fe01d715bdb3c3cc744426338c36de8a811a21dd_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:11c1f9ced80990086cee5ce279c370d0c77d51ccecc90b1505411e260a86a4c6_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:12b65f4633f5f40f9c69de277be3f818c97797b6dc3c196fce5b7f7bcf159483_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:1fc273414780a92a504e697cae92eff4e03ceb52e25fc3b801b4b315b51d0167_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:9717f972f0386f74583f2364c681141e91fa214c79efc16e7b52e7923044c347_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:a0f4c6db92988b7270706ab297c9eed1e543cb038764971af58496ce0b203468_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:c10383074fc1ecd27ca64e320fce56cbd0c06c11c5c66d318f882f45c73e1db5_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:e449df4d21c3ba372dc7d70db844e8f294ff532f2a83c34cdb41885d32d65b7e_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:e7b03b1bad85588cf7a20b9ef4d88a00ef39f0cdc0545a1b612b5a796860b02e_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:5838caa8e2b57dae013e16badc26b539a1dfa5f0b9cfaeaa99447bd9db2b9971_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:9a00a9d4e08d7ba27d12538379f21766bc199235d557ebfbcdede15a879cccd2_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:ac1656fd8288e9c61224fd27df38382dcc96dc7144eb4ccac7796aa9aa8620ad_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:e46b66060d7db6c2fd22e60e883e032e328dda49d53a158d1a6af806e6db2198_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9@sha256:2e300d404a102cbc1ab2a046f947c5097827bb70f2aa8fc7cb021f08886d636d_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:50e1f73353f1f0f0357cc127cb8c38181f2fcd86f8bda8301e57d536a91f49c4_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:70e034cc00f919777e176e0619ce7bb8b37120453fa6ce7671f30a0f902f1da5_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:78a7502b343d2936c593688806ffc40cf38d97827cb2738cdaa40080ea8dc3d1_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:7b6d8d3f8dcc746fe73c92e5517a80015c0a2b998c9202102b094329240b6ecb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:654bcc001f6e1a06e3f238bf7a8a4d626b500796a0734da81db8b1d9b257272e_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:68fe329a6f9f40ee3ab49f8fffaecbe953121390fc71be3b2f8cd60b43944ea1_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:9aedd86a2aabad67e93cfd56cede7fcec13a692458af9da9ecd4ee5a90ce4b24_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:b7b6e14ca7f27c9ae3f870c2c8934d8a2d38e5b3e48cdcf8b1ca91c032edf4c5_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:07634d90c2b50dfa9ca8812a6ba83a6d9742c09bf5987373b20ab0c35541511b_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:7643a991a51a241d8d8941e1a921645f5b65df06adcce843a70a05a376688bb4_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:b2b510cc63d74a17a5e1400d54629fa70ec2b3ae5059a4f16baa294169c2b7da_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:d226042a6b16152ac55bcb008c9e9079a69ae2f0a28319ea3beba1a2d88e10bb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • +56 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:994bbf87fec04efb0e89ffbc54b2d37590d48e6a804c78cf2cf62dd9bc156793 (For s390x architecture) The image digest is sha256:1d680915661aabcbff79625727c046a9ad2fbd6a8defebe91db904080bc31a38 (For ppc64le architecture) The image digest is sha256:f04b60e0d476794ef777791e8d13545a6d76c907f0bab2713124d72899429bfd (For aarch64 architecture) The image digest is sha256:7a9e327f5a79b67d4347203f63cd53dcdd508834355b3b3c766bb93db2859412 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.

🔗 References (4)