Important: Red Hat Security Advisory: OpenShift Virtualization v4.14 Images

Red Hat OpenShift Virtualization release v4.14 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

RHCOS 4 : OpenShift Container Platform 4.17.35 (RHSA-2025:10295)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10295 advisory. - podman: podman missing TLS verification CVE-2025-6032 - net/http: Request smuggling due to acceptance of invalid chunked data in...

RHCOS 4 : OpenShift Container Platform 4.15.29 (RHSA-2024:5754)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:5754 advisory. - golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString CVE-2022-23772 Note that Nessus has not...

RHCOS 4 : OpenShift Container Platform 4.14.35 (RHSA-2024:5436)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5436 advisory. - golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm CVE-2023-45290 -...

RHCOS 4 : OpenShift Container Platform 4.18.25 (RHSA-2025:16729)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16729 advisory. - podman: Build Context Bind Mount CVE-2025-4953 Note that Nessus has not tested for this issue but has instead relied only on the...

RHCOS 3 : Red Hat OpenShift Enterprise 3.2 (RHSA-2016:1853)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1853 advisory. - libarchive: Archive Entry with type 1 hardlink, but has a non-zero data size file overwrite CVE-2016-5418 Note that Nessus has not tested f...

RHCOS 4 : OpenShift Container Platform 4.12.78 (RHSA-2025:10271)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10271 advisory. - net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Note that Nessus has not tested for this...

RHCOS 2 : Red Hat OpenShift Enterprise 2.2.7 (RHSA-2015:1844)

The remote Red Hat Enterprise Linux CoreOS 2 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1844 advisory. - jenkins: Combination filter Groovy script unsecured SECURITY-125 CVE-2015-1806 - jenkins: directory traversal from artifacts via...

RHCOS 4 : OpenShift Container Platform 4.16.37 (RHSA-2025:1910)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1910 advisory. - podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile CVE-2024-11218 Note that...

RHCOS 4 : OpenShift Container Platform 4.12.74 (RHSA-2025:2443)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2443 advisory. - podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile CVE-2024-11218 Note that...

RHCOS 1 : openshift-origin-broker-util (RHSA-2014:0461)

The remote Red Hat Enterprise Linux CoreOS 1 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2014:0461 advisory. - mcollective: world readable client config CVE-2014-0164 Note that Nessus has not tested for this issue but has instead relied only on the...

RHCOS 9 : OpenShift Container Platform 4.17.14 (RHSA-2025:0656)

The remote Red Hat Enterprise Linux CoreOS 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0656 advisory. - jinja2: Jinja has a sandbox breakout through malicious filenames CVE-2024-56201 - jinja2: Jinja has a sandbox breakout through...

RHCOS 4 : OpenShift Container Platform 4.15.55 (RHSA-2025:11352)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11352 advisory. - net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Note that Nessus has not tested for this...

RHCOS 3 : atomic-openshift (RHSA-2016:1427)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1427 advisory. - Kubernetes: disclosure of information in multi tenant environments via watch-cache list CVE-2016-5392 Note that Nessus has not tested for...

RHCOS 9 : OpenShift Container Platform 4.16.14 (RHSA-2024:6827)

The remote Red Hat Enterprise Linux CoreOS 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:6827 advisory. - webob: WebOb's location header normalization during redirect leads to open redirect CVE-2024-42353 Note that Nessus has not tested for this...

RHCOS 4 : OpenShift Container Platform 4.18.6 (RHSA-2025:3068)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3068 advisory. - go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-27144 Note that Nessus has not tested for this issue but has instead...

RHCOS 4 : OpenShift Container Platform 4.12.60 (RHSA-2024:4008)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4008 advisory. - cri-o: malicious container can create symlink on host CVE-2024-5154 Note that Nessus has not tested for this issue but has instead relied...

RHCOS 3 : OpenShift Container Platform 3.9 (RHSA-2018:1227)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1227 advisory. - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go CVE-2018-1102 Note that Nessus has not tested fo...

RHCOS 4 : OpenShift Container Platform 4.11.16 (RHSA-2022:8534)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8534 advisory. - golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of...

RHCOS 4 : OpenShift Container Platform 4.17.16 (RHSA-2025:1122)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:1122 advisory. - cri-o: CRI-O Path Traversal in Log Handling Functions Allows Arbitrary Unmounting CVE-2025-0750 Note that Nessus has not tested for this...