Red Hat Security Advisory

RHSA-2025:1451

OpenShift Container Platform 4.14.48 security update

Released 2025-02-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-operator-marketplace, rhcos

Fixes 4 records

TI-2024-35574 CVE-2024-53104 · GHSA-fg92-6xpx-v2x4

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

CRITICAL 93KEV

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were n…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.03395 Published 2024-12-02 Partial fix · 4.19.324, 5.4.286 +7 CWE-787

TI-2024-11209 CVE-2024-12085 · GHSA-xh5q-pch5-g3xq

Rsync: info leak via uninitialized stack contents

HIGH 72

A flaw was found in rsync which could be triggered when rsync compares file checksums.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08641 Published 2025-01-14 Fixed in 3.4.1-2.el10, 3.0.6-12.el6_10.1 +209 CWE-908

TI-2024-30407 CVE-2024-45337 · GHSA-v778-237x-gjrc

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

MEDIUM 53

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03181 Published 2024-12-11 Partial fix · 0.31.0 CWE-285

TI-2024-30408 CVE-2024-45338 · GHSA-w32m-9786-jp63

Non-linear parsing of case-insensitive content in golang.org/x/net/html

LOW 32

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01072 Published 2024-12-18 Partial fix · 0.33.0 CWE-1333