Red Hat Security Advisory

RHSA-2026:44237

OpenShift Container Platform 4.22.7 bug fix and security update

Released 2026-07-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +1

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g

MEDIUM 57

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00471 Published 2026-05-12 Partial fix · 10.1.1 CWE-79

TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2

MEDIUM 45

spdystream is a Go library for multiplexing streams over SPDY connections.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00656 Published 2026-04-16 Partial fix · 0.5.1 CWE-770

TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p

MEDIUM 43

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00793 Published 2026-05-22 Partial fix · 1.8.4 CWE-77

TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021