PT-2025-4041 · Red Hat · Openshift Service Mesh

Name of the Vulnerable Software and Affected Versions: OpenShift Service Mesh versions 2.5.6 through 2.6.3 Description: The issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject maliciou...

Important: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.7.3 security updates and bug fixes

Multicluster Engine for Kubernetes 2.7.3 General Availability release images, which provide enhancements, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

Important: Red Hat Security Advisory: Red Hat OpenShift Builds 1.1

Red Hat OpenShift Builds 1.1 release Red Hat OpenShift Builds 1.1...

CVE-2025-0754

The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to lo...

CVE-2025-0752

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy...

Important: Red Hat Bug Fix Advisory: LVMS 4.17.4 Bug Fix Update

Updated container images that fix multiple bugs are now available for LVMS 4.17 Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to dynamically provision thin and thick local storage on a cluster with limited resources. Users of LVMS are advised to upgrade to the latest...

Important: Red Hat Bug Fix Advisory: LVMS 4.16.7 Bug Fix Update

Updated container images that fix multiple bugs are now available for LVMS 4.16 Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to dynamically provision thin and thick local storage on a cluster with limited resources. Users of LVMS are advised to upgrade to the latest...

Important: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.5.8 security updates and bug fixes

Multicluster Engine for Kubernetes 2.5.8 General Availability release images, which provide enhancements, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

Moderate: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.35.0 security update & enhancements

Release of OpenShift Serverless Logic 1.35.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.45 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.4.7 security updates and bug fixes

Multicluster Engine for Kubernetes 2.4.7 General Availability release images, which provide enhancements, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0

cert-manager Operator for Red Hat OpenShift 1.15.0 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0

cert-manager Operator for Red Hat OpenShift 1.15.0 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

A new version of Red Hat OpenShift distributed tracing platform Jaeger has been released Red Hat OpenShift distributed tracing platform based on Jaeger. Jaeger is a project inspired by Dapper and OpenZipkin. It is a distributed tracing system released as open source by Uber Technologies. It is us...

Moderate: Red Hat Enhancement Advisory: Advisory for publishing Helm 3.15.4 GA release

GA release of Helm 3.15.4 for OpenShift Container Platform 4.17 version. This errata advisory is for publishing the GA release of Helm 3.15.4 for OpenShift Container Platform 4.17 version...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0

cert-manager Operator for Red Hat OpenShift 1.15.0 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.4.1 release.

Red Hat Developer Hub 1.4 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single pa...

The vulnerability of the Red Hat OpenShift Container Platform corporate platform, related to uncontrolled resource consumption, allows a hacker to trigger a service failure.

The vulnerability of the Red Hat OpenShift Container Platform is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.4 release

A new version of Red Hat OpenShift distributed tracing platform Tempo has been released Red Hat OpenShift distributed tracing platform based on Tempo. Tempo is an open-source, easy-to-use, and highly scalable distributed tracing backend. It provides observability for microservices architectures b...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.6.27

Logging for Red Hat OpenShift - 5.6.27 Logging for Red Hat OpenShift - 5.6.27 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875...