RHSA-2025:19003 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.20.1 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.20.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.1. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/155454

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

Security Fix(es):

• dompurify: DOMPurify vulnerable to tampering by prototype pollution (CVE-2024-48910) * crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 (CVE-2025-22874)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:cbde13fe6ed4db88796be201fbdb2bbb63df5763ae038a9eb20bc793d5740416

(For s390x architecture)
The image digest is sha256:7ebf9b89942c0619685427117c5dcb9fc3ea3ce7fc48b878a37d620391332d5e

(For ppc64le architecture)
The image digest is sha256:6cdcf883799d2f97a7df564d732ea6226bed846bfd62cab55f224dbee02796f2

(For aarch64 architecture)
The image digest is sha256:29326919cd265074e9aaf16a57b817d3430d0504ab4ef96a8d9b273ee666f508

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Fixes

• BZ - 2322949
• BZ - 2372320
• OCPBUGS-52427 - [4.20] OCP can't provision Dell with IDRAC 10
• OCPBUGS-54487 - PowerVS: Unclear error when invalid VPC provided
• OCPBUGS-55217 - Optimistically update Kube Server and Client CA bundles
• OCPBUGS-57974 - kubernetes-nmstate-operator-Incorrect image for nmstate operator references in 4.20 branch - ART
• OCPBUGS-58212 - Remove `InsightsRuntimeExtractor` feature gate as it is no longer used
• OCPBUGS-58229 - MicroShift: Pod in offline scenario does not start after reboot after bumping CRIO to 1.33.1
• OCPBUGS-59568 - ose-containernetworking-plugins — False Missing Packages (dos2unix, util-linux)
• OCPBUGS-59650 - Rebase main branch for cloud-provider-openstack onto upstream
• OCPBUGS-59678 - PowerVS Support VPC and TG ids
• OCPBUGS-60194 - OLMv1 crdUpgradeSafety fails due to unhandled Items changes
• OCPBUGS-60466 - Cloud event proxy for PTP operator doesn't parse the BF3 NIC names correctly
• OCPBUGS-60649 - [HyperShift] TestUpgradeControlPlane EnsureNoCrashingPods test failing too often
• OCPBUGS-61239 - The node-encap-ips annotation should not be set when running in DPU host mode
• OCPBUGS-61453 - pod(VM) on default network->pod on localnet (with VLAN & external router) on same node is broken
• OCPBUGS-61555 - Bump to Kubernetes v1.33.5
• OCPBUGS-61581 - Linuxptp-daemon doesn't parse the BF3 NIC names correctly
• OCPBUGS-61638 - Update OWNERS file for image-registry repository
• OCPBUGS-61778 - OVNK downstream with DPF failing to run upstream script
• OCPBUGS-61779 - Fix OVN-K deployment using Node Feature Discovery annotation in CNO
• OCPBUGS-61784 - [release-4.20] The msg description in the SCAAvailble condition isn't accurate enough when failing to parse the response
• OCPBUGS-61845 - [release-4.20]Forbidden errors in Insights Operator pod logs
• OCPBUGS-61848 - Updation of label from edit label doesn't work
• OCPBUGS-61861 - "cluster in workload identity mode" isn't applied with the token-auth-azure annotation
• OCPBUGS-61890 - more enum values cannot be added for an existing field
• OCPBUGS-61990 - Import YAML editor has tab default to 4 spaces
• OCPBUGS-62005 - [4.20][storage.k8s.io/v1beta1] should be served on TechPreviewNoUpgrade hosted clusters
• OCPBUGS-62006 - Ignition Server certificate secrets deleted if disable-pki-reconciliation annotation is present
• OCPBUGS-62017 - 4.21: E2E: Create testing namespace before Runtime LLC tests
• OCPBUGS-62019 - The progressing condition won't be changed when the gathering pod is deleted accidentally
• OCPBUGS-62023 - 4.20 E2E: OVS Dynamic pinning test fixes
• OCPBUGS-62024 - Warning message related to 4.21 updates is incorrect
• OCPBUGS-62025 - E2E: Modify test checking kernel sysctl to verify kernel.time_migration is not enabled when rt_kernel is false in Performance profile
• OCPBUGS-62095 - "ulimit -n" just 1024 (instead of 1048576)
• OCPBUGS-62140 - OCPSTRAT-2045:Automating OCPSTRAT-2045 feature in upstream
• OCPBUGS-62174 - MCP reporting wrong number of ready nodes when Image Mode is disabled
• OCPBUGS-62175 - Cluster Storage Operator's allow-egress-to-api-server NetworkPolicy is not compatible with HyperShift's KAS port customization
• OCPBUGS-62182 - KAS Bootstrap container seeing restarts within timeout period in AKS e2es with KMS enabled
• OCPBUGS-62196 - [release-4.20] Missing period on the auth error page
• OCPBUGS-62214 - E2E: Add function to check control plane nodes are schedulable
• OCPBUGS-62216 - Marketplace e2e test failures blocking the PR merging
• OCPBUGS-62258 - cluster-csi-snapshot-controller-operator's allow-egress-to-api-server NetworkPolicy is not compatible with HyperShift's KAS port customization
• OCPBUGS-62273 - [release-4.20] egressIP GARP sent by incorrect node after reboot
• OCPBUGS-62275 - Prometheus scraping: default to legacy validation/escaping scheme until utf-8 is fully supported by prom-operator
• OCPBUGS-62283 - [v2] show binary version in the output
• OCPBUGS-62297 - GCP Upgrade causes DNS deletion of private zone failure
• OCPBUGS-62305 - Support CapacityReservationPreference in CAPI e2e automation
• OCPBUGS-62308 - TestImageRegistryPods test failing in CMO end-to-end test suite
• OCPBUGS-62316 - Missing service for port 6385
• OCPBUGS-62336 - [release-4.20] Pod stuck in ContainerCreating state after upgrading to 4.18.16
• OCPBUGS-62463 - oc-mirror creates tar file even after errors from image pull
• OCPBUGS-62640 - RendezvousIP template not replaced in /etc/assisted/rendezvous-host.env causing OVE cluster installation failure
• OCPBUGS-62650 - kube-compare double loads some objects
• OCPBUGS-62654 - PR ClusterProvisioned stuck in Unknown due to ClusterInstance rendering error
• OCPBUGS-62656 - agent-extract-tui runs continuously leaving host inaccessible
• OCPBUGS-62675 - Cert Controller should live fetch SAN IPs during cert rotation
• OCPBUGS-62678 - High CPU usage for iptables-alerter pods
• OCPBUGS-62695 - CNTRLPLANE-1308: Enable OTE for OCM and OCM Operator
• OCPBUGS-62722 - [olmv1] ClusterExtension status and message cannot reflect the real state: Too long: may not be more than 32768 bytes
• OCPBUGS-62749 - Backport Konflux to branch release-4.20 in agent-installer-utils
• OCPBUGS-62750 - Add mcd_local_unsupported_packages metric from MCO to telemetry
• OCPBUGS-62755 - [release-4.20] cluster-api operator blips degraded every 35 minutes
• OCPBUGS-62801 - [sig-arch] events should not repeat pathologically for ns/openshift-machine-config-operator
• OCPBUGS-62844 - [4.20] Remove info message logging for csi-driver-node deployment, csi-node-registrar container
• OCPBUGS-62846 - Installing dual stack SNO with primary IPv6 is blocked
• OCPBUGS-62867 - HyperShift ServiceMonitor for cluster-version-operator metrics: revert client auth
• OCPBUGS-62913 - EgressIP Failover not working
• OCPBUGS-62935 - Add type validation in installer for MTU and similar numeric fields in install-config.yaml
• OCPBUGS-62979 - [release-4.20] After disabling local AlertMananager, there are still AlertManager alerts, and AlertManager related DNS queries
• OCPBUGS-63035 - [jobsets] Surface cert-manager dependency error in JobSet CR status
• OCPBUGS-63044 - [lws] Surface cert-manager dependency error in LeaderWorkerSets CR status
• OCPBUGS-63057 - ClusterInstance fails to render when skipping hardware provisioning
• OCPBUGS-63249 - cold boot test both nodes ungraceful shutdown results in unresponsive cluster

CVEs

• CVE-2024-48910
• CVE-2025-22874

References

• https://access.redhat.com/security/updates/classification/