RHSA-2025:10767 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.18.20 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 4.18.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.18.20. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHSA-2025:10768

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

Security Fix(es):

• sudo: LPE via host option (CVE-2025-32462)
• net/http: Request smuggling due to acceptance of invalid chunked data in

net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.18 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:5e06105a6ba80d04eb5d8d3f9a672fb743ce4710876d99a375c2d9f7b7eaa783

(For s390x architecture)
The image digest is sha256:2771caf2e2feb31b09ba8c940df42c16b98aceb455156fdf247025ae80e169ab

(For ppc64le architecture)
The image digest is sha256:1e7c7b5eb1d96ce6c285f292ffbe1a7a757c99ea4ad2945a05723bb95c2b591e

(For aarch64 architecture)
The image digest is sha256:399af8a368f954b6804c3d76d0553eed55435f123a5e362d03b3f5c6aff262ac

All OpenShift Container Platform 4.18 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

• Red Hat OpenShift Container Platform 4.18 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.18 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.18 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for Power 4.18 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.18 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.18 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.18 for RHEL 9 aarch64
• Red Hat OpenShift Container Platform for ARM 64 4.18 for RHEL 8 aarch64

Fixes

• BZ - 2358493 - CVE-2025-22871 net/http: Request smuggling due to acceptance of invalid chunked data in net/http
• BZ - 2374692 - CVE-2025-32462 sudo: LPE via host option
• OCPBUGS-43939 - Machine config doesn't start in SNO 4.18 metal upgrades
• OCPBUGS-46401 - [4.18] Virtual machines using primary UDN layer2 end up with IPv6 multipath gateway
• OCPBUGS-46629 - [4.18] kubevirt hosted cluster with apiserver noderport using hostname ends without network policies
• OCPBUGS-47495 - [4.18] ignition: panic when fips.enable
• OCPBUGS-56434 - Cluster CAPI operator: should not use v1beta1 of the AdmissionRegistration API group
• OCPBUGS-56624 - chk_default_ingress perma-failing
• OCPBUGS-57037 - 2 port Ordinary clock backport to 4.18 - Linuxptp
• OCPBUGS-57070 - Problem with cAdvisor metrics for multipath devices
• OCPBUGS-57124 - [v2] oc mirror - error when mirroring image name ends with the word 'delete'
• OCPBUGS-57197 - [v2] oc-mirror v2 generate non-unique archive file names
• OCPBUGS-57213 - "Create PodDiscruptionBudget" on PodDisruptionBudget page
• OCPBUGS-57286 - Netwoking - Services - Pods : Ellipsis menu missing
• OCPBUGS-57318 - [4.18] ovnkube-node pod restart results into crashloopback/error state post deleting the CUDN resource
• OCPBUGS-57328 - autoSizingReserved allocating too low CPU reservation
• OCPBUGS-57427 - [release-4.18] high snapshot rate on redhat-operators, OLM operator install hangs. RPC DeadlineExceeded while listing bundles.
• OCPBUGS-57767 - [release-4.18] OLMv1: faulty parsing of olm.maxOpenShiftVersion allows cluster upgrades when they should be blocked
• OCPBUGS-57818 - HostedCluster registry and release providers are recreated on every reconcile
• OCPBUGS-57931 - [4.18] Modals launched with `useModal` overwrite each other
• OCPBUGS-57935 - machine-config ClusterOperator should include MachineConfiguration in relatedObjects
• OCPBUGS-57947 - [4.18.z] Allow selection of kernels with different page sizes in PerformanceProfile
• OCPBUGS-57964 - oc-mirror errors out showing it trying to fetch from registry.redhat.io, in air-gapped env.
• OCPBUGS-57970 - Seeing "content filepath is tainted" error when running d2m
• OCPBUGS-58044 - Boot image controller should correctly handle marketplace boot images
• OCPBUGS-58067 - MOB doesn't update container image on upgrade
• OCPBUGS-58088 - Cannot read properties of undefined (reading 'filter') error while accessing nodes from console
• OCPBUGS-58095 - Bond-CNI pod failed to recover IPv6 address config after bond interface restart
• OCPBUGS-58126 - customizes the liveness probe on IBM Cloud
• OCPBUGS-58135 - [4.18] Upgrade RHCOS to OVS 3.5 to stay in sync with ovn-kubernetes
• OCPBUGS-58264 - nip.io no longer is available causing installer vsphere unit tests to fail
• OCPBUGS-58346 - e2e: arm: Add arm kernelPageSize e2e testing suite
• OCPBUGS-54744 - Work around excess CA certs in additionalTrustBundle
• OCPBUGS-55246 - [release-4.18] RW hostPath mount in kube-rbac-proxy-crio static pod violates best practices in RHOCP4
• OCPBUGS-55297 - [IBM VPC] set offlineExpansion to false in e2e test manifest
• OCPBUGS-56609 - unit test failure caused by etcd image removing latest tag
• OCPBUGS-56928 - Backport bridge-cni isolated changes
• OCPBUGS-58159 - 4.18 OVS and OVN patch level pinning creates Image Grading Issues
• OCPBUGS-58233 - `oc adm node-image create` command fails with the error messaging giving no feedback information even in the report.json.
• OCPBUGS-58312 - Fix OAuth-Proxy tests
• OCPBUGS-58317 - [release-4.18] Performance issue - plugins pages increased loading time (10s) compared to ocp4.18
• OCPBUGS-58321 - SNO installation with UPI failed

CVEs

• CVE-2022-49846
• CVE-2023-52477
• CVE-2023-52565
• CVE-2023-52595
• CVE-2023-52781
• CVE-2023-52834
• CVE-2024-12718
• CVE-2024-23337
• CVE-2024-26717
• CVE-2024-35790
• CVE-2024-35807
• CVE-2024-35924
• CVE-2024-36006
• CVE-2024-36940
• CVE-2024-39471
• CVE-2024-41092
• CVE-2024-41097
• CVE-2024-43880
• CVE-2024-46826
• CVE-2024-54661
• CVE-2024-56614
• CVE-2025-4138
• CVE-2025-4330
• CVE-2025-4435
• CVE-2025-4517
• CVE-2025-6020
• CVE-2025-22126
• CVE-2025-22871
• CVE-2025-32462
• CVE-2025-48060

References

• https://access.redhat.com/security/updates/classification/#important