RHSA-2025:2652 - Security Advisory

Topic

Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4.18.0 on Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift DataFoundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multi-cloud data management service with an S3 compatible API.

Security Fix(es):

• node-gettext: Prototype Pollution (CVE-2024-21528)
• cross-spawn: regular expression denial of service (CVE-2024-21538)
• PostCSS: Improper input validation in PostCSS (CVE-2023-44270)
• nanoid: nanoid mishandles non-integer values (CVE-2024-55565)
• golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CVE-2024-45337)
• golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)
• k8s.io/kubernetes: kubelet: node denial of service via kubelet checkpoint API (CVE-2025-0426)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the RHODF-4.18-RHEL-9 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Data Foundation 4 for RHEL 9 x86_64
• Red Hat OpenShift Data Foundation for IBM Power, little endian 4 for RHEL 9 ppc64le
• Red Hat OpenShift Data Foundation for IBM Z and LinuxONE 4 for RHEL 9 s390x
• Red Hat OpenShift Data Foundation for RHEL 9 ARM 4 aarch64

Fixes

• BZ - 2311014 - CVE-2024-21528 node-gettext: Prototype Pollution
• BZ - 2324550 - CVE-2024-21538 cross-spawn: regular expression denial of service
• BZ - 2326998 - CVE-2023-44270 PostCSS: Improper input validation in PostCSS
• BZ - 2331063 - CVE-2024-55565 nanoid: nanoid mishandles non-integer values
• BZ - 2331720 - CVE-2024-45337 golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
• BZ - 2333122 - CVE-2024-45338 golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
• BZ - 2345617 - CVE-2025-0426 k8s.io/kubernetes: kubelet: node denial of service via kubelet checkpoint API
• DFBUGS-731 - [2319372] [4.18]: Deployemnt failed with "Failed to set node Topology Map for StorageCluster"
• DFBUGS-700 - [2277298] [GSS] Namespace store stuck in rejected state
• DFBUGS-463 - [2320939] noobaa operator code is missing 'ap-southeast-5' AWS region
• DFBUGS-387 - [2280212] [Non Contanerized NSFS] Bucket policies can't limit a bucket owner's access to his own buckets
• DFBUGS-309 - [2319334] [RDR] Relocate of ceph fs is stuck in WaitForReadiness
• DFBUGS-276 - [2302136] [RFE] Detailed Log Line for Inaccurate Proxy/noProxy Definition- NooBaa MCG
• DFBUGS-90 - [2312533] Noobaa Account not getting reconciled due to absence of forceMd5Etag in CR
• DFBUGS-822 - [MCG-4.18] Listing buckets via the MCG CLI fails due to INVALID_SCHEMA_PARAMS error
• DFBUGS-916 - [UI] kebab menu does not allow to click on menu items
• DFBUGS-925 - Placeholder bug to backport RDR for Provider Mode changes
• DFBUGS-906 - dataloss due to the concurrent RPC calls (occurrence is very low)
• DFBUGS-943 - csiaddons failed to resolve endpoint
• DFBUGS-942 - csiaddonsnode doesn't have delete rbac
• DFBUGS-941 - rbac for volumereplicationclasses missing
• DFBUGS-940 - Finalizer for mirroring is not a qualified name
• DFBUGS-908 - Add sc encryption checkbox UI for Attach Storage UI
• DFBUGS-866 - [RDR] When incorrect target cluster is selected for failover/relocate operations, the existing warning alert "Inconsistent data on target cluster" doesn't go away
• DFBUGS-865 - [RDR] Incorrect message under warning alert Inconsistent data on target cluster for Relocate operation
• DFBUGS-963 - For provider mode rdr maintenance mode is not getting triggered
• DFBUGS-726 - [2322458] Virtualization storage class isn't created upon presence of VirtualMachine CRD
• DFBUGS-353 - [2317744] [UI] BackingStore details shows incorrect provider
• DFBUGS-351 - [2308314] [UI] In Storage Clients page options window doesn't close if we click anywhere outside of the option box like any other pages
• DFBUGS-313 - [2317212] Storage client filtering by name not working correctly
• DFBUGS-156 - [2281587] Tooltip rendered behind other components
• DFBUGS-67 - [2319131] Possible race when key rotation lock time out is reached
• DFBUGS-976 - ocs-metrics-exporter pod crashlooping for Provider clusters
• DFBUGS-911 - MCO does not label VolumeSnapshotClass or VolumeReplicationClass with StorageID
• DFBUGS-871 - [UI] hide builtin-nfs-pool to the user.
• DFBUGS-778 - Add info alert about RHCS settings for EiT in external Mode
• DFBUGS-637 - [2254035] OSD pods scheduling is inconsistent after adding osd placement spec
• DFBUGS-495 - [2261950] [ODF Hackathon][RFE][Add supportability to disable in-transit encryption]
• DFBUGS-201 - [2314900] NooBaa CLI: Attempting to delete a bucketclass or OBC that don't exist doesn't result in an error
• DFBUGS-389 - [2311546] Object bucket claim creation triggers an admission webhook warning
• DFBUGS-1261 - ControllerGetVolumeGroup, DeleteVolumeGroup and DeleteVolumeGroupSnapshot RPCs are not idempotent
• DFBUGS-938 - ceph-csi-controller-manager pods OOMKilled
• DFBUGS-902 - [RDR] Upgrade from 4.17 to 4.18 is stuck
• DFBUGS-867 - [RDR] UI blocks a DR operation on an appset based workload
• DFBUGS-845 - [2114838] ocs-operator-container: TM: Role with too wide permissions in ClusterRole [openshift-data-foundation-4]
• DFBUGS-727 - [2316928] For external cluster, collect non secure secret data for debugging
• DFBUGS-682 - [2310160] UI Misalignment in ?Connect to a Key Management Service? Form while creating encrypted storageclass
• DFBUGS-663 - [2315619] [ACM Tracker] [RDR] Discovered apps - Failed to create secrets in openshift-adp ns after adding CACertificates. Also policy is in NonCompliant state.
• DFBUGS-602 - [2322019] [RDR] [Flatten] Proper error messages aren't shown when a drpolicy without flattening is applied to cloned/snapshot restored PVC
• DFBUGS-580 - [2319824] [RDR] Replication via Volsync requires PVC to be mounted before PVC is synchronized
• DFBUGS-489 - [2312118] [UI] A 404: Not Found message is briefly displayed for a few seconds when clicking on the ?Enable Encryption? checkbox during StorageClass creation.
• DFBUGS-410 - [2322178] [UI] Error message Popup fail to alert on rule: Cannot be used before
• DFBUGS-368 - [2313424] [GSS] MDSCacheUsageHigh alert firing
• DFBUGS-365 - [2276204] [RDR] [Hub recovery] [Co-situated] CURRENTSTATE and PROGRESSION takes longer to retain their status post hub recovery
• DFBUGS-198 - [2294843] [RFE] Deploying ODF for external IBM FlashSystem storage using thick volumes that do not format as thin volumes causes warnings/errors on the Flashsystem side with storage calculations which disables the pool from creating new volumes
• DFBUGS-182 - [2307976] [MDR][RDR][RFE] Inconsistency between Fusion B/R and Ramen Recipes
• DFBUGS-258 - [2302858] - [odf-multicluster-console] Pod Service Account Token Automatically Mounted
• DFBUGS-1285 - PrometheusDuplicateTimestamps alerts generated by rook-ceph-osd-key-rotation-X pods
• DFBUGS-160 - [2315464] [GSS] CephCluster progressing state due to validation check fail, sees two zones instead of three
• DFBUGS-499 - [2308598] Fencing may occur in parallel to pod eviction on nodes tainted with out-of-service annotation
• DFBUGS-851 - [IBM Z ] - OSD pods on CLBO state in ODF 4.18
• DFBUGS-730 - [2321538] OSD pods on CLBO state in ODF 4.18 due to segmentation fault On Power
• DFBUGS-839 - rook-ceph-osd-prepare-ocs-deviceset pods produce duplicate metrics
• DFBUGS-137 - [2302235] [UI deployment][ODF on ROSA HCP] No correct labels on the worker nodes
• DFBUGS-1662 - Failover is struck in WaitForStorageMaintenanceActivation

CVEs

• CVE-2023-44270
• CVE-2024-11187
• CVE-2024-21528
• CVE-2024-21538
• CVE-2024-45337
• CVE-2024-45338
• CVE-2024-55565
• CVE-2025-0426
• CVE-2025-1244

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.18/html/4.18_release_notes/index