Red Hat Security Advisory

RHSA-2025:4427

OpenShift Container Platform 4.18.12 bug fix and security update

Released 2025-05-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.18 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-console-rhel9, openshift4/ose-olm-catalogd-rhel9 +1

Fixes 4 records

TI-2024-36876 CVE-2024-55549 · GHSA-g8fv-r98j-937r

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.

HIGH 67

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.

CVSS 3.1HIGH 7.8 Local No auth No interaction EPSS 0.00358 Published 2025-03-14 Partial fix · 1.1.43 CWE-416

TI-2025-18564 CVE-2025-24855 · GHSA-3cgj-v3m4-cgcq

Use after free in xmlsoft libxslt

LOW 36

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored.

CVSS 3.1HIGH 7.8 Local No auth No interaction EPSS 0.00358 Published 2025-03-14 Partial fix · 1.1.43 CWE-416

TI-2025-20001 CVE-2025-27144 · GHSA-c6gw-w398-hv78

Go JOSE's Parsing Vulnerable to Denial of Service

LOW 35

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00399 Published 2025-02-24 Partial fix · 4.0.5, 3.0.4 CWE-770

TI-2024-06598 CVE-2024-7128 · GHSA-gwr6-5fvh-8v7r

Openshift-console: unauthenticated data exposure

LOW 30

A flaw was found in the OpenShift console.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00414 Published 2024-07-26 Partial fix · v4.16.0-202508060805.p0.gc145016.assembly.stream.el9, v4.17.0-202505061536.p0.gd71a401.assembly.stream.el9 +1 CWE-200