Red Hat Security Advisory

RHSA-2025:1123

OpenShift Container Platform 4.16.34 security and extras update

Released 2025-02-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.16 openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator, openshift4/ose-operator-sdk-rhel9

Fixes 4 records

TI-2024-11209 CVE-2024-12085 · GHSA-xh5q-pch5-g3xq

Rsync: info leak via uninitialized stack contents

HIGH 72

A flaw was found in rsync which could be triggered when rsync compares file checksums.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08641 Published 2025-01-14 Fixed in 3.4.1-2.el10, 3.0.6-12.el6_10.1 +209 CWE-908

TI-2024-30408 CVE-2024-45338 · GHSA-w32m-9786-jp63

Non-linear parsing of case-insensitive content in golang.org/x/net/html

LOW 32

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01072 Published 2024-12-18 Partial fix · 0.33.0 CWE-1333

TI-2024-37287 CVE-2024-56326 · GHSA-q2x7-8rv6-6q7h

Jinja has a sandbox breakout through indirect reference to format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00522 Published 2024-12-23 Partial fix · 3.1.5 CWE-1336

TI-2024-37171 CVE-2024-56201 · GHSA-gmj6-6f8f-6699

Jinja has a sandbox breakout through malicious filenames

LOW 26

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00307 Published 2024-12-23 Partial fix · 3.1.5 CWE-150