Red Hat Security Advisory

RHSA-2025:17501

RHOAI 2.24.0 - Red Hat OpenShift AI

Released 2025-10-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift AI 2.24 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-modelmesh-rhel9, registry.redhat.io/rhoai/odh-rhel9-operator

Fixes 4 records

TI-2025-07108 CVE-2025-7783 · GHSA-fjxv-7rqg-78g4

Usage of unsafe random function in form-data for choosing boundary

HIGH 76

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.0181 Published 2025-07-18 Partial fix · 2.5.4, 3.0.4 +1 CWE-330

TI-2025-34845 CVE-2025-55163 · GHSA-prj3-ccx8-p6x4

Netty MadeYouReset HTTP/2 DDoS Vulnerability

MEDIUM 44

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.01125 Published 2025-08-13 Partial fix · 4.1.124.Final, 4.2.4.Final +1 CWE-770

TI-2025-09818 CVE-2025-10725 · GHSA-g829-2387-h324

Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

MEDIUM 44

A flaw was found in Red Hat Openshift AI Service.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00722 Published 2025-09-30 Fixed in 3.0.0, sha256:cebc8815e03b772343b15d0a7dce8fad6fcc71dd437d871db5a3691472350803 +4 CWE-266

TI-2025-35721 CVE-2025-57852 · GHSA-33j5-frrm-3wg2

Openshift-ai: privilege escalation via excessive /etc/passwd permissions

LOW 28

A container privilege escalation flaw was found in KServe ModelMesh container images.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00157 Published 2025-09-30 Fixed in sha256:97e2bd9b587f08e135a9aeb9b3e0dc6eafa1a9bdacbb5ecb681ce9bd5aa37fc9, sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16 +3 CWE-276