Red Hat Security Advisory

RHSA-2025:21368

Red Hat OpenShift Data Foundation 4.18 security, enhancement & bug fix update

Released 2025-11-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16

TI-2025-16096 CVE-2025-22150 · GHSA-c76h-2ccp-4975

HIGH 65

Undici is an HTTP/1.1 client.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00763 Published 2025-01-21 Partial fix · 5.28.5, 6.21.1 +1 CWE-330

TI-2025-05315 CVE-2025-5889 · GHSA-v6h2-p8h4-qcjw

MEDIUM 45

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00611 Published 2025-06-09 Partial fix · 1.1.12, 2.0.2 +2 CWE-1333

TI-2022-00097 CVE-2022-0155 · GHSA-74fj-2j2h-c42q

LOW 34

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02608 Published 2022-01-10 Partial fix · 1.14.7 CWE-359

TI-2022-00456 CVE-2022-0536 · GHSA-pw2r-vq6v-hr8c

LOW 29

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01337 Published 2022-02-09 Partial fix · 1.14.8 CWE-212

TI-2025-06557 CVE-2025-7195 · GHSA-856v-8qm2-9wjv

LOW 28

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00243 Published 2025-08-07 Partial fix · 0.15.2, v4.17.39-2 +119 CWE-276