RHSA-2024:11037 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.19.0 is now available with updates to packages and images that fix several bugs.

This release includes a security update for Red Hat OpenShift Container Platform 4.19.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.19.0. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHSA-2024:11038

Security Fix(es):

• golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may

cause authorization bypass in golang.org/x/crypto (CVE-2024-45337)

• golang.org/x/net/html: Non-linear parsing of case-insensitive content in

golang.org/x/net/html (CVE-2024-45338)

• golang.org/x/oauth2/jws: Unexpected memory consumption during token

parsing in golang.org/x/oauth2/jws (CVE-2025-22868)

• golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of

golang.org/x/crypto/ssh (CVE-2025-22869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Affected Products

• Red Hat OpenShift Container Platform 4.19 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.19 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.19 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for Power 4.19 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.19 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.19 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.19 for RHEL 9 aarch64
• Red Hat OpenShift Container Platform for ARM 64 4.19 for RHEL 8 aarch64

Fixes

• BZ - 2331720 - CVE-2024-45337 golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
• BZ - 2333122 - CVE-2024-45338 golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
• BZ - 2348366 - CVE-2025-22868 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
• BZ - 2348367 - CVE-2025-22869 golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
• OCPBUGS-44879 - [LSO] Need to remove /mnt/local-storage/sc-name on the worker after delete localvolume/localvolumeset
• OCPBUGS-45095 - [LSO] optimize requeue time when LV / LVS is deleted
• OCPBUGS-46439 - backporting NFD operand upstream into downstream
• OCPBUGS-46446 - sriov 4.19 version bump
• OCPBUGS-46566 - backport NFD operator to release-4.18
• OCPBUGS-47512 - remove kube-rbac-proxy container from NFD operator
• OCPBUGS-47731 - pod annotations does not include rdma-device field[release-4.19]
• OCPBUGS-48384 - backporting NFD operator to release-4.19
• OCPBUGS-31059 - LSO ignoring existing LVDR scsi-* symlinks for PV re-creation
• OCPBUGS-49658 - Backporting NFD operator to release-4.19
• OCPBUGS-50496 - update samples CR to remove the default operand image
• OCPBUGS-46419 - Unexpected PF reset for Mellanox ConnectX-6 MT2892 causing VFs to detach from pods
• OCPBUGS-44354 - Multi-NetworkPolicy not working for default port field with protocol field defined
• OCPBUGS-51011 - SR-IOV: Race Condition Between NetworkPool and NodePolicy Removal
• OCPBUGS-51038 - [LSO] localvolumeset sc does not remove after delete localvolumeset instance and pv
• OCPBUGS-52955 - SriovNetworkNodePolicy reconciler runs too often
• OCPBUGS-53346 - Default value seems to be set to false for the parameters enableInjector and enableOperatorWebhook in SriovOperatorConfig.spec. which gives <none> output.
• OCPBUGS-54160 - [4.19] Fatal error concurrent map write results in sidecar crash and losing past events
• OCPBUGS-54380 - SriovNetworkNodeState stuck in InProgress
• OCPBUGS-54543 - Data race in Server.status access causes instability in cloud-event-proxy
• OCPBUGS-20159 - Document how to enable LSO metrics after installation
• OCPBUGS-54428 - ptp all sync-state event should be FREERUN. Instead sends event as LOCKED
• OCPBUGS-55294 - Remove Topology CRD deployment from NFD
• OCPBUGS-55690 - NFD GC must be able to list/delete downstream NodeFeature objects
• OCPBUGS-56198 - noise: error parsing phase offset value not found dpll
• OCPBUGS-56271 - [4.19] Enable ARM Arch for SR-IOV Network Operator
• OCPBUGS-56619 - updating the clustrolebindings for prune and topology to the correct SA

CVEs

• CVE-2024-45337
• CVE-2024-45338
• CVE-2025-22868
• CVE-2025-22869

References

• https://access.redhat.com/security/updates/classification/#important