Red Hat Security Advisory

RHSA-2026:63103

OpenShift Container Platform 4.20.37 bug fix and security update

Released 2026-09-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-prometheus-rhel9 +1

Fixes 7 records

TI-2026-33367 CVE-2026-45623 · GHSA-6g55-p6wh-862q

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

HIGH 78

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00608 Published 2026-07-27 Partial fix · 8.5.12 CWE-200

TI-2026-48541 CVE-2026-69192 · GHSA-mwp4-54f8-5fhr

Improper input validation in beaugunderson ip-address

HIGH 75

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00465 Published 2026-08-03 Partial fix · 10.3.1 CWE-20

TI-2026-32848 CVE-2026-44990 · GHSA-rpr9-rxv7-x643

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

HIGH 75

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00684 Published 2026-06-12 Partial fix · 2.17.4 CWE-79

TI-2026-39172 CVE-2026-54272 · GHSA-22jq-vg5j-6vgg

ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

HIGH 70

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00401 Published 2026-07-27 Partial fix · 10.2.1 CWE-20

TI-2026-48533 CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp

Information disclosure in postcss

MEDIUM 61

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00451 Published 2026-08-03 Partial fix · 8.5.19, 8.5.23 CWE-200

TI-2026-26186 CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

MEDIUM 40

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-05-07 Partial fix · 0.53.0, 1.25.10 +1 CWE-835

TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj

Prometheus Azure AD remote write OAuth client secret exposed via config API

LOW 39

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00352 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +1 CWE-200