RHSA-2026:82813HighCVSS 9.3

Red Hat Security Advisory: OpenShift Container Platform 4.15.70 bug fix and security update

Published
October 22, 2026
Last Modified
October 25, 2026

🔗 CVE IDs covered (17)

CVE-2026-33814 →CVE-2026-39830 →CVE-2026-75887 →CVE-2026-44990 →CVE-2026-83589 →CVE-2026-93017 →CVE-2025-65637 →CVE-2026-39829 →CVE-2026-46597 →CVE-2026-49329 →CVE-2026-59869 →CVE-2026-66138 →CVE-2026-75885 →CVE-2026-39831 →CVE-2026-39832 →CVE-2026-44918 →CVE-2026-75888 →

📋 Description

CVE-2025-65637 — github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-44918 — openstack-ironic: Prevent rehoming resources to nodes with different owner CVE-2026-44990 — sanitize-html: sanitize-html: Stored Cross-Site Scripting via HTML sanitizer bypass CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-49329 — openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-66138 — ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration CVE-2026-75885 — openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint CVE-2026-75887 — openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler CVE-2026-75888 — openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch CVE-2026-83589 — oauth-proxy: Open Redirect via /\ and /\t Bypass in Post-Login Redirect CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:081b7e0c087ada7e655b6fb176be8b5bd102862be5bffcce6fe26fd2c6881712_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:35af9c5531d564d12d06d68f38c61bb29f60fda13e82a83784b8b74082c27f1d_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:3cb32ee6e0d28e7ea8906988fdd82b71920dd04d45db34dba5aa051bd46c7fc5_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:6d5a7aced2a2a045b91f78ffa0150b086206075243dbfd5c7d3f4dab4dc7acf7_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:701a8c7823eab4e7f948d329e920dbebceed89dea67d02953cb02d9ab1e0b884_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9d6cc3bbfaf4c2a2ecffef1bf5e9e3f3914f2916b38cff20093ef5df0de98800_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:a5e4b50ccb0688467fb9bb279cb850ae01be3e190e1d302f83b84f9cabe01679_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e8933c260048e37718937bb4c288b836dad7d5be21be7364d82a9a6b97f3b901_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:0a362856fc4d70a4574e195c7261c69b344e9b055dea5330f5bb202ec7390c4a_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:669912cba50bfaceed3bb6f52e028863644e3de74443c57eb6a13479de5aa6f4_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:a89c80bd9b0c0939170d15030afa93238f6caf3fbf2684add8e2d6231d51cc35_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:b5176560480d72b8c94649e43976152915ef3a30b8b7c81ca1057bac59972db9_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:189f4c56f7666b34cd7b44510b418c906de477f083b11d64ccf4c5038862e898_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:4f5fdb1f59ddd5af655880cc321e552aac87ec7f22cff6486b9456313648b8f4_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:6560d0b52ae480efe71d43e42f4dfa64e65169d9899eb10ef85b70c98ec044c4_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kube-metrics-server-rhel8@sha256:8642ccbe6ed25f1faa8f33de05888511c625f3da8430fcaa7c405ae683dfcb81_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:a31b6ce439227b6f843c0e2e2a5d93597add527721105b68b650a0777eb5f1e4_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:a37b37cac04f9de2973bdb75c8180f8ac6eeefb7ed69c4ff23df1abfd31c5212_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:aae3b09c2f55b62f85d31e09928f6df0d8918db5a8583cb4e8b337347adbf6f7_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:ea6d6a8014d70a3465112288b068fd933a0fe12b891236c694baccd341977dff_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:7bcad38eb1106abbbaa59eae29d591be27456e31e5d238661a1d6a1866906969_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:95eb97eec9f1cf4dc1ed4f62d06bd4fa57200961eaf6062888ca21b8f98eea2d_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:b79659718fb92db20a559f194794bcb928f2a303250e631f17f24d99f3210ee3_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:d9af349ca64a438cd6ac5e121791964518e6ac5cbcc429f5e42c5fae925bb85a_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:25cdb52636e8920a0d93bc50b356dea7631050e35f67074b4b891fff1783d528_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:5fa9239b817e72f6614f41d4b2658578b76375f378c4267a68f74323395374c4_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:60d6396c08dfa4cbf41ee2c705dca74b5c87ceec1b2811d42aa080812b8bee82_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:6e572502be42d10c46ed37e077e8de730b4bf8d7a19b882353de091b5cd6532c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:7b20c002f3c9704d1f936106ec61b01e6e144e68fe57a4bc4a9a12e8e74cfa4d_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff (For s390x architecture) The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f (For ppc64le architecture) The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01 (For aarch64 architecture) The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Operators who are concerned they may have had this occur are encouraged to perform a basic audit of node configuration, for instance, ensuring the expected number of volume targets and volume connectors are present. Operators can also use the provided ironic-status upgrade check to identify misconfigured nodes. Workaround: Until an OpenShift update containing the vendor fix is available, place an external WAF or load balancer that terminates TLS in front of the OAuth endpoint. Configure it to reject requests with an Accept-Language header larger than 4 KiB or with more than 32 combined - and _ separators. Rate-limit unauthenticated requests to the OAuth login and error endpoints as an additional defense. The proxy must re-establish TLS to the existing OAuth route, preserve the OAuth hostname/SNI, and validate the backend certificate. Do not disable TLS verification or expose the OAuth service directly. If an external TLS-terminating control cannot be deployed, there is no supported OpenShift router-only mitigation while the OAuth route remains TLS passthrough. Restricting access to the OAuth endpoint to trusted networks can reduce exposure but may affect user access. Upgrade to the first OpenShift release containing the fix as soon as it is available. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Remove the chronyd binary from the Ironic Python Agent (IPA) ramdisk image. The vulnerable code path is only reached when chronyd is detected as available. Without chronyd, IPA will either use ntpdate for time synchronization (which is not affected by this vulnerability, as it passes the NTP server address as a separate process argument without shell interpolation) or skip time synchronization entirely if neither tool is available. Additionally, restrict and segment the provisioning network to prevent rogue mDNS responders, and review OpenStack RBAC policies to limit which users can modify kernel_append_params on bare metal nodes. Workaround: https://access.redhat.com/solutions/7148487 Workaround: Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.

🔗 References (20)