RHSA-2026:59834HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.97 security and extras update

Published
September 3, 2026
Last Modified
September 17, 2026

🔗 CVE IDs covered (2)

CVE-2025-68121 →CVE-2026-32280 →

📋 Description

CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

🎯 Affected products41

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:bc5f01e04efb9f375c2ed43eeb6c266dba7127aeb50f178f06e46069d5a53949_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/frr-rhel8@sha256:5ba6602342d687cc95d760744ccd28c790fea871786006fee2e2bb6423c2abf1_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel8-operator@sha256:5b2c5e38a67c63899bc3ca06c2fb3d8e869c911cb45e42578fdcd4c33f7fc322_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/metallb-rhel8-operator@sha256:ce075bf6f863c43b24a5b0b32a2a0058d412a7d0109ba056671e6da48f07b240_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/metallb-rhel8@sha256:57425613b12f7029b54d0860a276e953101740365eecd164f936b995133fbe3a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-ansible-operator@sha256:bdf4e5777ea10f55962201c76ac8d641389ad4aa51311406a1b385244f3f9976_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:9784abfad5de978b1e701c24b9175a273a7f0f34c481ced530f180856e1a0c05_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:fc6fc54ef17cb955f0684ff1883e39588b9969d583a525e84ffcf1b27f3e337d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel8@sha256:bc5f01e04efb9f375c2ed43eeb6c266dba7127aeb50f178f06e46069d5a53949_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cloud-event-proxy@sha256:bc5f01e04efb9f375c2ed43eeb6c266dba7127aeb50f178f06e46069d5a53949_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cluster-capacity@sha256:c1c8e942a62ba8f33428bbf34a1cada226363f33923b97065900bdaee9e3aa92_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:db52cd25aee8b0a3ed84da9a8cb3045e57db6576d71c01e21447a7dbb333e8a2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:3f2417db45d342dcef4d6c908b8ac8389ebe1ce40edcb751b5927707277b7855_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8@sha256:4dfcc38ad71ea7cc09c26016989a54d3cd506ba159361eaaabcf0d027aa1af89_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-contour-rhel8@sha256:8d106c4d8ccd6f32b13714328619f02f18fde4acb7121643baaa3b44fcf74dd1_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:aa641118a31fbe46b8266a1d7758c0c9ba8643a0693b3adc79855bcacbb960f9_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-egress-dns-proxy@sha256:b5a92d8083e4dcfb5b35be87eb355b0237c111f2cd68ec6e7338a1e570a8abb5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-egress-http-proxy@sha256:b6c6a942fb4a0f2c80d720cfc2f1474d0aded2f209cf6eb2478dccaf1afbccbb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-egress-router@sha256:a3bcea71bc4b83db325864edddf0f493d99f45e59a4c2b007e4e86e33fc8b686_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8-operator@sha256:69680910c75ce807ba6fe68b9bcb2abf1e80d81c8c5a4f1349af1c240706a007_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:41ce168aaa196f3759eb4d00fba7fb52d65d5acc719436f402635169fe658b7e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-helm-operator@sha256:102cd0678fa8e0e2647057488d4403d177471f090a659471111d00a244ef0267_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:fc703633ed68a521530226aac6a74274385e603e65288e3cbad293ba7e13d847_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:a9485870df51d68d85b482778e58a26259f01e57ee4deb5efefbbaf76486fa06_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:218c429bb750196e99b3574c73047ddb7bacb81b1f84d356d7e3ef578419b8db_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:391386843098703d515427e017200f8197b13343f7fd98fc8c7a5e1d3c17ca31_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-node-feature-discovery@sha256:43e6567f68921e036717436ce49daeb2863ee41ea303978782d2f14d98389b6d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-operator-sdk-rhel8@sha256:0258c590023d09fd369f75d27ca20cdd0f63051268756dbed4e5b1382a996846_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-ptp-operator@sha256:7dbf5147b82a07e274764ba15b47c10505b172eae95164db0fe5efee3271d942_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +11 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.

🔗 References (5)