Red Hat Security Advisory

RHSA-2025:19306

OpenShift Container Platform 4.15.59 bug fix and security update

Released 2025-11-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-multus-admission-controller-rhel9, registry.redhat.io/openshift4/ose-oauth-proxy-rhel9

Fixes 3 records

TI-2024-30407 CVE-2024-45337 · GHSA-v778-237x-gjrc

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

MEDIUM 53

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03181 Published 2024-12-11 Partial fix · 0.31.0 CWE-285

TI-2024-32607 CVE-2024-48910 · GHSA-p3vf-v8qc-cwcr

DOMPurify vulnerable to tampering by prototype polution

MEDIUM 51

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01151 Published 2024-10-31 Partial fix · 2.4.2 CWE-1321

TI-2025-16743 CVE-2025-22871 · GHSA-g9pc-8g42-g6vq

Request smuggling due to acceptance of invalid chunked data in net/http

MEDIUM 49

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00842 Published 2025-04-08 Partial fix · 1.23.8, 1.24.2 +1 CWE-1395