Red Hat Security Advisory

RHSA-2025:0115

OpenShift Container Platform 4.17.12 bug fix and security update

Released 2025-01-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.17 openshift4/ose-cloud-credential-rhel9-operator, openshift4/ose-console-rhel9, openshift4/ose-docker-builder-rhel9

Fixes 3 records

TI-2024-14351 CVE-2024-21626 · GHSA-xr7r-f8xq-vfvv

runc container breakout through process.cwd trickery and leaked fds

HIGH 72

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.18923 Published 2024-01-31 Partial fix · 1.1.12 CWE-403

TI-2024-30408 CVE-2024-45338 · GHSA-w32m-9786-jp63

Non-linear parsing of case-insensitive content in golang.org/x/net/html

LOW 32

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01072 Published 2024-12-18 Partial fix · 0.33.0 CWE-1333

TI-2024-33751 CVE-2024-50312 · GHSA-7f25-p8gc-hxqh

Graphql: information disclosure via graphql introspection in openshift

LOW 31

A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00559 Published 2024-10-22 Fixed in v4.16.0-202501080105.p0.g6fe3e8b.assembly.stream.el9, v4.17.0-202501080135.p0.gedbd12e.assembly.stream.el9 +163 CWE-200