RHSA-2025:3973 - Security Advisory

Topic

Red Hat OpenShift Virtualization release 4.16.7 is now available with updates to packages and images that fix several bugs and add enhancements.

Description

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.

This advisory contains OpenShift Virtualization 4.16.7 images.

kubevirt-ssp-operator-rhel9-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)
kubevirt-tekton-tasks-create-datavolume-rhel9-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)
kubevirt-tekton-tasks-disk-virt-customize-rhel9-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)
kubevirt-template-validator-rhel9-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)
vm-console-proxy-rhel9-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)
kubevirt: net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Container Native Virtualization 4.16 for RHEL 9 x86_64

Fixes

• BZ - 2295310 - CVE-2024-24791 net/http: Denial of service due to improper 100-continue handling in net/http
• BZ - 2333122 - CVE-2024-45338 golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
• CNV-54615 - [cnv-4.16] [test_id:4135]should find VMI namespace on namespace label of the metric
• CNV-51123 - [4.16.4] Example prefernce in UI still points to instancetype.kubevirt.io/v1alpha2
• CNV-48884 - [v4.16.5] Update Windows-11 IT/Preferences to reflect TPM to be persistent:True
• CNV-48883 - [v4.16.5] Unable to express `spec.domain.firmware.bootloader.efi.persistent` with preferences
• CNV-56325 - VM snapshot tab cannot be loaded
• CNV-55568 - [4.16] size-detection pod is not always cleaned after it completes
• CNV-48157 - [UI] 4.15 virt-launcher pod intermittently 404 when navigating from VM page
• CNV-56920 - limit resource configuration is not applied to initcontainer for importer-prime pod.
• CNV-50785 - [4.16] VMStorageClassWarning alert should fire only for clusters with Win VMs
• CNV-48124 - [Tracker Bug] [cnv-4.16] VMs fail to start for larger vcpu counts (>=64)
• CNV-52035 - [4.16] Velero backup PartiallyFailed due to PVC' failing to be snapshoted
• CNV-56674 - Taking VM snapshot fails
• CNV-54971 - [4.16] Snapshot Creation Fails for Powered-Off VM with RerunOnFailure RunStrategy

CVEs

• CVE-2019-12900
• CVE-2020-11023
• CVE-2022-49043
• CVE-2023-52653
• CVE-2024-2236
• CVE-2024-5535
• CVE-2024-8176
• CVE-2024-9287
• CVE-2024-11187
• CVE-2024-12085
• CVE-2024-12797
• CVE-2024-23848
• CVE-2024-24791
• CVE-2024-26976
• CVE-2024-27010
• CVE-2024-27410
• CVE-2024-35810
• CVE-2024-35888
• CVE-2024-35925
• CVE-2024-45338
• CVE-2024-50264
• CVE-2024-52531
• CVE-2024-55549
• CVE-2024-56171
• CVE-2025-1244
• CVE-2025-22013
• CVE-2025-24928
• CVE-2025-26465

References

• https://access.redhat.com/security/updates/classification/#important