Red Hat Security Advisory

RHSA-2025:0140

OpenShift Container Platform 4.16.30 bug fix and security update

Released 2025-01-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.16 openshift4/ose-cloud-credential-rhel9-operator, openshift4/ose-console-rhel9, rhcos

Fixes 3 records

TI-2024-30408 CVE-2024-45338 · GHSA-w32m-9786-jp63

Non-linear parsing of case-insensitive content in golang.org/x/net/html

LOW 32

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01072 Published 2024-12-18 Partial fix · 0.33.0 CWE-1333

TI-2024-33751 CVE-2024-50312 · GHSA-7f25-p8gc-hxqh

Graphql: information disclosure via graphql introspection in openshift

LOW 31

A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00559 Published 2024-10-22 Fixed in v4.16.0-202501080105.p0.g6fe3e8b.assembly.stream.el9, v4.17.0-202501080135.p0.gedbd12e.assembly.stream.el9 +163 CWE-200

TI-2024-07887 CVE-2024-8508 · GHSA-g7cv-x9wx-38gx

Unbounded name compression could lead to Denial of Service

LOW 31

NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00801 Published 2024-10-03 Partial fix CWE-606