Red Hat Security Advisory

RHSA-2025:3066

OpenShift Container Platform 4.18.6 bug fix and security update

Released 2025-03-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.18 openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel9, openshift4/ose-cloud-credential-rhel9-operator +1

Fixes 2 records

TI-2024-37146 CVE-2024-56171 · GHSA-m366-8h8r-6fqr

Use after free in xmlsoft libxml2

MEDIUM 45

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01178 Published 2025-02-18 Partial fix · 2.12.10, 2.13.6 CWE-416

TI-2025-20001 CVE-2025-27144 · GHSA-c6gw-w398-hv78

Go JOSE's Parsing Vulnerable to Denial of Service

LOW 35

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00399 Published 2025-02-24 Partial fix · 4.0.5, 3.0.4 CWE-770