RHSA-2025:1838 - Security Advisory

Topic

Red Hat OpenShift Virtualization release 4.18.0 is now available with updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.

This advisory contains OpenShift Virtualization 4.18.0 images.

Security Fix(es):

• golang.org/x/net/html: Non-linear parsing of case-insensitive content in

golang.org/x/net/html (CVE-2024-45338)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Container Native Virtualization 4.18 for RHEL 9 x86_64

Fixes

• BZ - 2242803 - CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
• CNV-49306 - removeEventListener is undefined
• CNV-48475 - [4.99] VMExport broken due to missing openshift specific RBAC
• CNV-43128 - Downloading virtctl memory-dump results in empty tar file.
• CNV-42401 - [Bug] In OCP-Virt console during VM creation, enabling Dynamic SSH key injection after customizing cloud-init can cause cloud-init to fail
• CNV-49427 - VirtualMachineExport may trigger alert VirtControllerRESTErrorsHigh
• CNV-48532 - The VM became Paused during storage class migration (stage)
• CNV-49577 - nodeSelector and Toleration throw admission hook error
• CNV-48861 - [v4.99] SSPFailingToReconcile alert with log error 'Missing registry source","ssp"'
• CNV-48184 - Snapshot are automatically deleted when their original vm is deleted
• CNV-47535 - VMI status shows the IP of eth0 instead of the OVN-UDN1 that is bound to the VM
• CNV-41232 - Configuring IP address in GUI, cursor jumps to end of line
• CNV-50055 - Infinite loading vm list
• CNV-49347 - UI: VirtualMachineSnapshot YAML shows apiVersion v1alpha1 when it's v1beta1
• CNV-41403 - Sometimes the VM tabs reload 2-4 times
• CNV-50732 - preference spread options ratio should align to cpu requirements
• CNV-47273 - Cannot create a vm with no network interface attached
• CNV-35199 - The pipeline in Quick Starts does not work
• CNV-34076 - [2170455] Two "PVC Delete" warning appears while deleting a PVC which has a datavolume
• CNV-50805 - Can't snapshot VM
• CNV-49572 - Layout is broken on VM Configuration tab
• CNV-49299 - Cloned example VM does not start
• CNV-34339 - Did a typo in the URL to import a PVC for VM disk, now UI is stuck and cannot fix the typo without going to console
• CNV-51085 - Welcome modal cannot be turned off
• CNV-49040 - Unnecessary fields are displayed in subscription settings
• CNV-45733 - Network graph not scale in VM metric
• CNV-49376 - virtctl vmexport is stuck when VMI element is in Succeeded status
• CNV-51247 - Validation for APIService fails due FailedDiscoveryCheck
• CNV-41812 - OpenShift Virtualization Overview page does not show all VMs in "VirtualMachines per resource"
• CNV-51157 - [MTC]Need to manually delete old pvc for multiple migrations
• CNV-51225 - [4.18] VMSnapshot 'InProgress' and Failing for a VM with InstanceType and Preference
• CNV-50278 - cdi-deployment pod encountering nil pointer errors when default virt storageclass changes
• CNV-50957 - Hotplugging a non-persistent disk through virtctl and subsequently making it persistent through the UI does not result in the disk becoming persistent.
• CNV-40584 - warm migration is failing because Virtual image size is larger than the reported available storage
• CNV-51973 - Remove template based tasks from kubevirt tekton tasks
• CNV-51229 - [cnv-4.18] Target pod requires a longer time than needed to go in succeeded status
• CNV-48733 - Error not properly propagated on fsfreeze failure
• CNV-48562 - [RFE] Allow user to type NAD in "Add network interface" modal
• CNV-42158 - Localnet configuration seem to get stuck to previous versions, not what is currently declared
• CNV-52004 - VM tree view can't be reopened
• CNV-51018 - [UserDefinedNetwork] TCP client connection must be re-generated after migration
• CNV-46683 - Check for new SAST issues in cnv 4.18
• CNV-52406 - Search results highlight is too bright
• CNV-52393 - The storageclass of new added disk is not presenting in disk tab
• CNV-52386 - The "Cancel" button does not work on storageclass migration modal
• CNV-52273 - Virtualization icon is bigger than others in perspective switcher
• CNV-52253 - [4.16] Error not properly propagated on fsfreeze failure
• CNV-52252 - [4.17] Error not properly propagated on fsfreeze failure
• CNV-51249 - DataSources do not react properly when default virtualization storage class changes
• CNV-46452 - Completing an incomplete StorageProfile does not reconcile the relevant incomplete DVs, unlike missing StorageClass
• CNV-44959 - VMs status IPs do not show the proper ip when using ovn-kubenertes primary UDN
• CNV-51910 - Segfault on PVC webhook rendering when no default/virt default StorageClass is set and PVC has no StorageClass specified
• CNV-51223 - Status label value in kubevirt_vm_info metric should be in lower case
• CNV-46672 - [CWE-79] main - containerized-data-importer - ?pkg/uploadproxy/uploadproxy.go - Cross-site Scripting (XSS)
• CNV-52272 - [4.18] size-detection pod is not always cleaned after it completes
• CNV-53287 - The Settings -> User -> permissions is not aligned
• CNV-52447 - Primary UDN attachments do not have IPv4 addresses
• CNV-51059 - [UserDefinedNetwork + multus] IP addresses not assigned in VM with primary UDN and secondary multus
• CNV-50230 - VM Export: Backend storage PVC not included
• CNV-51469 - Checkbox column in VM list is too wide for regular user
• CNV-53956 - [4.18] PVs of the prime and scratch PVCs are stuck Terminating
• CNV-53354 - virtctl: Log verbosity cannot be set anymore
• CNV-53286 - UserDefinedNetwork is missing on Virtualization perspective
• CNV-41165 - vmiCPUAllocationRatio 1 fails
• CNV-52128 - [CI-Watcher] CI is down due to i18n msising key issue
• CNV-51071 - [4.18 gating] VirtualMachineRestore fails with 'run strategy has to be Halted'
• CNV-51572 - VM selection checkbox is not checked
• CNV-42051 - DataVolumeError VM status doesn't show when encountering image pull errors
• CNV-54239 - Stop button is missing when run tests via cypress
• CNV-54208 - The dropdown menu of "Actions" is not closed by clicking somewhere else
• CNV-53392 - Bug: detect zero option to preserve sparseness during storage migration
• CNV-53355 - Block volume hotplug broken with crun >= 1.18
• CNV-51515 - [MTC] blockrsync-server pod is NotReady during storage class migration
• CNV-47190 - [4.18] Storage checkup failed reason is not consistent for pvc and snapshot source format
• CNV-54188 - Change "Move to folder" to "Save"
• CNV-51352 - VM actions dropdown does not auto-close when focus is lost
• CNV-43589 - Paste access credentials is not working for me
• CNV-51150 - Fedora 41 not found in Templates for 4.18
• CNV-48104 - Remove centos7 and centos stream8 in Catalog -> Template tab
• CNV-31844 - Adding 255 disks to a VM fail with synchronizing error
• CNV-54331 - FQDN is missing in VM Overview tab -> Network section
• CNV-54221 - Project becomes "empty project" when click the breadcrumb link on VM details page
• CNV-54110 - VM with UDN network cannot be started
• CNV-53189 - Make PUSH_TIMEOUT param optional and not required
• CNV-51966 - virtctl create vm doesn't validate that name can be used as part of disk name
• CNV-50766 - Cannot delete NIC from VM while the NIC is delete from another VM
• CNV-53403 - NAD name becomes [object Object] in network modal
• CNV-52452 - Navigation menus disappear for non-priv user
• CNV-52237 - VM disk is not saved a bootable volume
• CNV-52174 - virtctl expose should create service per VM
• CNV-50449 - Console SecureBoot configuration does not match VM definition
• CNV-53967 - Project "default" is not displayed in treeview
• CNV-53452 - VirtualMachines page crashes for nonpriv user
• CNV-53212 - There is an alignment issue when VMs have different status
• CNV-52283 - The "Next" button is disabled in storageclass migration modal
• CNV-52246 - [e2e] add 'data-test-id' to sub-tabs under VM's configuration tab and Diagnostics's tab
• CNV-51588 - Network selection menu behavor is changed
• CNV-50471 - BootableVolumes list with no namespace column
• CNV-49528 - Out-of-the-box console window without the need to scroll
• CNV-49307 - Creating new NNCP with form switches perspective
• CNV-52060 - Persistent Hotplug disk is not made Persistent after VM restart
• CNV-52059 - SSH key secret creation accepts invalid (for volume) name
• CNV-51653 - The volume list in catalog is not sorted properly
• CNV-51386 - Observe page is blank in Virtualization perspective
• CNV-49026 - Remove"Hide deprecated bootable volumes" on Catalog -> InstanceTypes tab
• CNV-53453 - Virtualization User Tree view settings are not disabled for nonpriv user
• CNV-55056 - Storage Migration: ability to switch volumeMode and accessMode of the target volumes
• CNV-50228 - VM Snapshot: Backend storage PVC not included
• CNV-55082 - kubevirt-disk-uploader uses internal image
• CNV-55048 - default public ssh key not listed in "settings" "user" "Manage ssh keys"
• CNV-53248 - The crendentials of pulling images from registry does not pass to customize wizard
• CNV-41410 - Kubevirt-velero-plugin restore object graph doesnt exist
• CNV-55353 - kubevirt-ipam-controller-manager pod stuck in CrashLoopBackOff status when spinning a large amount of VMs (500)
• CNV-54866 - StorageProfile snapshotClass is not honored when creating a VM snapshot
• CNV-55111 - Selected Boot mode is changed to different value when VM is created
• CNV-54646 - [disk-uploader] panic got created for a missing/deleted volume
• CNV-55143 - [docs] Fix machine configuration and add explicit warning about usage of resources.requests.memory
• CNV-55697 - Editing fast InstanceType on created VM crash the page
• CNV-55454 - Metrics view of VM in the WebUI freezes and page stops responding
• CNV-42175 - VM Stuck Provisioning With Only VMINotExists Reason
• CNV-55167 - [RFE] Bond ports are not shown in GUI
• CNV-55107 - The value of 'CPU | memory' could not refresh after switch the project
• CNV-50554 - The create button on MultiNetworkPolicies and NetworkPolicies list page is in wrong position
• CNV-41922 - Alerts are displayed in the wrong order in the Virtualization Overview page
• CNV-55749 - expanding VM disk size throws error in GUI but size is reflected in VM.
• CNV-55744 - NetworkAttachmentDefinitions page crashes after creating NAD
• CNV-56336 - UI: the primary UDNs are created using a wrong template
• CNV-56076 - CUDN cannot be created thorugh the UI if there is no existing UDN
• CNV-55845 - Tree view flickering when it should be off
• CNV-55234 - UDN page list view "namespace" column says "All Namespace"
• CNV-55131 - Dialog creating the primary namespaced UDN does not need "name" field
• CNV-53260 - kubevirt_vm_resource_{requests|limits} metrics don't report InstanceType resources
• CNV-52319 - UnsupportedHCOModification alert should fired when there is an jsonpatch annotation to modify an operand CRs test unstable
• CNV-51412 - Openshift Virt HCO repeat events at deployment
• CNV-51403 - Alert OperatorConditionsUnhealthy is firing more than once per cluster
• CNV-55239 - CUDN dialog requires selection of existing projects
• CNV-56364 - Documentation links are outdated
• CNV-56004 - Add NIC modal will crash UI if VM don't have any NIC
• CNV-55457 - Network tab in new project dialog cannot work
• CNV-55085 - UDN Details "Layer configuration" should be flat
• CNV-51219 - Error while creating OVS bridge mappings using GUI - invalid NetworkState or NetworkPolicy: ovn: unknown field `bridge-mapping`
• CNV-55748 - Live resize/ expand of VM disk (PVC) does not update the size in summary page.
• CNV-56676 - VM treeview is not loaded for nonpriv user
• CNV-56499 - Boot mode menu displays wrong strings
• CNV-52080 - [MTC]PVC is pending when migrate a VM from OCS to HPP StorageClass
• CNV-56725 - Pre-defined instance type table is outdated
• CNV-55900 - add/edit disk in customize VM crashes
• CNV-55276 - [4.18] Add Support for AIO Buffer Configuration in Warm Migration
• CNV-51546 - UI attempts to visualize deleted VM, instead of 'VM not found"
• CNV-56219 - Guided tour is broken
• CNV-51198 - The example of DataSource does not work
• CNV-55842 - [CNV 4.18.0]Tracker bug: rpm errata release
• CNV-54111 - The UserDefinedNetworks presents under NetworkAttachmentDefinitions
• CNV-48195 - Some documentation link on OpenShift Virtualization page is incorrect

CVEs

• CVE-2019-12900
• CVE-2024-10963
• CVE-2024-12085
• CVE-2024-38598
• CVE-2024-45338
• CVE-2024-50602
• CVE-2024-52531
• CVE-2024-53088
• CVE-2024-53122

References

• https://access.redhat.com/security/updates/classification/#important