RHSA-2025:21132 - Security Advisory

Topic

Red Hat OpenStack Services on OpenShift (RHOSO) 18.0.14 containers are now available.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenStack Services on OpenShift is a hybrid cloud solution for deploying and managing virtualized and containerized applications in a scalable infrastructure with a Red Hat OpenShift Container Platform (RHOCP) control plane.

Security Fix:

• Postgres Scan Race Condition (CVE-2025-47907)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update as a new RHOSO 18.0 deployment, see “Deploying Red Hat OpenStack Services on OpenShift” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/deploying_red_hat_openstack_services_on_openshift/index

For details on how to apply this update to an existing RHOSO 18.0 deployment, see "Updating your environment to the latest maintenance release" at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index

Affected Products

• Red Hat OpenStack Services on OpenShift

Fixes

• OSPRH-20821 - Allow nodeset inventory to be updated with overall failed deployment status
• OSPRH-20507 - imagemeta weigher is not able to find the existing image properties
• OSPRH-20382 - During edpm update run bootc variable are undefined.
• OSPRH-20335 - Make httpd parameters configurable
• OSPRH-20331 - RHOSO 18.0 RabbitMQ uses TLS 1.3 and key update events cause RabbitMQ network partition
• OSPRH-20166 - bootstrap role fails with Exec format error: b'/etc/ansible/facts.d/edpm.fact'
• OSPRH-20033 - Make httpd parameters configurable
• OSPRH-19873 - [lib-common] nad: do not try to unmarshal empty string
• OSPRH-19720 - must-gather doesn't trigger GMR for manila pods because of permissions problems
• OSPRH-19648 - Keystone bootstrap and cronjobs not working if memcached mtls enabled
• OSPRH-19553 - DB dumps should be collected for all cells
• OSPRH-19471 - network attachment definition not found should sometimes raise error or warning instead of info log level
• OSPRH-19214 - Prefixes to advertise RHOSO services via BGP are wrong when IPv6 is used
• OSPRH-18804 - libvirtd default logging is overly verbose
• OSPRH-18758 - must-gather does not allow to pass parameter to limit e.g. the journal-size
• OSPRH-18585 - remove TLS conditional for include of conf.d/*.conf in httpd.conf
• OSPRH-17882 - must-gather doesn't trigger GMR for cinder pods because of permissions problems
• OSPRH-10961 - [horizon-operator] Make httpd Timeout Configurable
• OSPRH-10957 - [swift-operator] Make httpd Timeout Configurable
• RHOSSTRAT-1004 - Unified Keystone Quotas in Glance
• RHOSSTRAT-974 - Implement ability to customize tolerations
• RHOSSTRAT-919 - Watcher: consume and potentially send notifications using an independent notification bus for OpenStack
• RHOSSTRAT-914 - Rebase rabbitmq-cluster Operator to v2.16.0
• RHOSSTRAT-900 - Allow max-bw only QoS policies to use the OVN policer
• RHOSSTRAT-876 - Enable notification support in Storage operators
• RHOSSTRAT-848 - Feature - Support Prometheus exporter for OVS/OVN metrics (northd, RAFT)
• RHOSSTRAT-847 - Feature - Support Prometheus exporter for OVS/OVN metrics (OCP Gateways, ovn-controller/ovs-vswitchd)
• RHOSSTRAT-803 - Backport Manila PowerScale driver to 18
• RHOSSTRAT-784 - Share Transfers across tenants
• RHOSSTRAT-775 - Feature - OVN provider Testing and CI improvements - Full support
• RHOSSTRAT-684 - Swift Deployment on Dataplane Nodes (Full Support)
• RHOSSTRAT-670 - Adoption: Glance with Cinder Back-end
• RHOSSTRAT-654 - Adoption of RHOSP 17.1 with high availability for instances - instance HA
• RHOSSTRAT-613 - Multi-Realm Federation Support
• RHOSSTRAT-606 - Glance Image Caching API
• RHOSSTRAT-507 - Cinder-iSCSI Adoption Automation
• RHOSSTRAT-291 - Manila with Ceph Ganesha Adoption

CVEs

• CVE-2025-47907

References

• https://access.redhat.com/security/updates/classification/
• https://catalog.redhat.com/software/containers/search