RHSA-2026:39894HighCVSS 8.2

Red Hat Security Advisory: Release of containers for RHOSO 18.0.21

Published
July 15, 2026
Last Modified
August 29, 2026

🔗 CVE IDs covered (3)

CVE-2025-52881 →CVE-2026-23490 →CVE-2026-32280 →

📋 Description

CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2026-23490 — pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

🎯 Affected products131

  • Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/barbican-rhel9-operator@sha256:a7f59f1e7c7381cb1cc9d9deb8e05811233683432db49bb03439709c056e35f8_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/cinder-rhel9-operator@sha256:28301f4f8b1c2510e9b4bb9e253eee0266949a136831534588d12f166bccc128_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/designate-rhel9-operator@sha256:97dad11454fbe7e397850cf18a10657e1964779a122f6ac228044447d166c495_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/ee-openstack-ansible-ee-rhel9@sha256:18d956b794aeeb762fa3ad6ed6b15d6513035406cf851a361e0d1f09ed43af42_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/glance-rhel9-operator@sha256:766313d87a01fca4857dabc7befc0b34b3ddc5e27cb4012d60bdeec6f99ed5c7_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/heat-rhel9-operator@sha256:f19e8088aaaf5d5ed6fdcfcdfbb1203e583b8865fac8e4ea3a222b9a14ecc2f7_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/horizon-rhel9-operator@sha256:5bdca1dc296677e613796ca16d87548cb85350db0c6105e36f8406ca834fdb93_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/infra-rhel9-operator@sha256:49aa50cb8fa56b42af9dc47ef465395760e139ea854d2f84837332b5a9e2edad_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/ironic-rhel9-operator@sha256:2855a98dde02b11f0fb1029ec4f89df9c49ee178c3e073907fe616bf6308235d_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/keystone-rhel9-operator@sha256:5511f454518fc12455a47a9882f6697b1ba796878857109c63bcd946675b1d7e_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/manila-rhel9-operator@sha256:bec42585ef27f353931a3b69fcd6a03a8020f7605077bc02762de94c4ffc80fb_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/mariadb-rhel9-operator@sha256:bd2a0873e8b7b00c37749ff65ac9d68877c2b13e3da43d43f6f3160cdfd1367f_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/mysqld-exporter-rhel9@sha256:2094fc3bde1d6060207fd649a64837513ca8303bf41ec795cedc8d90a1068544_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/neutron-rhel9-operator@sha256:6434013e71cbc1bd9c703b876e54124944922b9d313a50c385d1040f38551978_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/nova-rhel9-operator@sha256:011bf714e723b82a43aef0fe7ff9fc3479f2259320ab68a9c1a9b3e4ac20ac3b_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/octavia-rhel9-operator@sha256:2fce21ac220fc706abdbd138750dc6d935f5cccfdafc2bfffff15ea5d65395b1_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-baremetal-agent-rhel9@sha256:2de6791ea8b1a537a2e78f360695a6b2a444af460ce082fec4c9a92d16f0482b_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-baremetal-rhel9-operator@sha256:2f8ef66a7da6c7bdc4374a23785cd7343ac38aaa6ed6c1e8e6b335198347fb76_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-must-gather-rhel9@sha256:d4c8a49c9d1efb5956573f8d55512db00d4ce23f5375b4d0f1004021104b8d29_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-network-exporter-rhel9@sha256:67ff558499300b093cecc62ae79f53003a828a1a50762874d9d22c3a47f23de4_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-operator-bundle@sha256:d26c9d4d7c62231a180f8a33aafd54d03da3a03b1ca1070e7a7a2b55f59db1bc_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-rhel9-operator@sha256:6ad7df72ed580e6f0e5e7f517c9b5c04011981fd2d15ba52a7c583d3b47f26c6_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/ovn-rhel9-operator@sha256:112b3034d398bafa049408b701c4ac0ba59376808058c58294415d33efa8f49f_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/prometheus-podman-exporter-rhel9@sha256:6b91b5fd5d38b9577ef1f1950575cc620294d945fc72f3d42d1bc8f934a4c76c_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/sg-core-rhel9@sha256:7b71443197a0b7591620aad8ce476c3bb0b12130a4ee95e90cac3417694af485_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/swift-rhel9-operator@sha256:63ca7de729e3e71192bdc05ce209d09a80959b37e7f34caaa2c5c7c19183a05e_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/telemetry-rhel9-operator@sha256:8f35e81bed2b31fa52deec93d13480234317540faf88d033596848d4a82348a0_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/test-rhel9-operator@sha256:08312137f57f35b00b79711f6de8bdb6d3ea7c38d940d867cb39a4ba99a89f92_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/watcher-rhel9-operator@sha256:d4ca11a077e4cfd4148c7a61d9045bf77e60b2c07d7ef4273545bb71c19914e5_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • +101 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update as a new RHOSO 18.0 deployment, see “Deploying Red Hat OpenStack Services on OpenShift” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/deploying_red_hat_openstack_services_on_openshift/index For details on how to apply this update to an existing RHOSO 18.0 deployment, see “Updating your environment to the latest maintenance release” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout.

🔗 References (7)