RHSA-2025:9278 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.19.1 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.19.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.19.1. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHSA-2025:9279

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Security Fix(es):

• net/http: Request smuggling due to acceptance of invalid chunked data in

net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.19 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:4d7f10e383deb0c5402f871bf66ebdcad6bb670cb3cf1668bfec5166c56f3196

(For s390x architecture)
The image digest is sha256:d670092bd3e9c7449edf5b718ec5910a6982a38f34cb4106c8f0132cd56c416d

(For ppc64le architecture)
The image digest is sha256:da4444f073479d98a21394e497644cc0f5570ab79881575a4b58ad363f317057

(For aarch64 architecture)
The image digest is sha256:b43a63a68f21da74ef93ed8abbb29237daa66d9df559d2071eb931d798041cd4

All OpenShift Container Platform 4.19 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

• Red Hat OpenShift Container Platform 4.19 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.19 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.19 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for Power 4.19 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.19 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.19 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.19 for RHEL 9 aarch64
• Red Hat OpenShift Container Platform for ARM 64 4.19 for RHEL 8 aarch64

Fixes

• BZ - 2358493 - CVE-2025-22871 net/http: Request smuggling due to acceptance of invalid chunked data in net/http
• OCPBUGS-57007 - [v2] Original catalog signature should not be mirrored to the target
• OCPBUGS-55701 - [v2] when oc-mirror version 4.18.3, 4.18.4 and 4.18.5 graph image synchronization generates an error
• OCPBUGS-55798 - Sync CA bundle from legacy location to root credential
• OCPBUGS-56100 - Azure HCP CAPI provider pod memory surge/leak on idle cluster
• OCPBUGS-56187 - Fix PIS failures on SNO
• OCPBUGS-56191 - Applicable MCN & PIS origin tests should run on SingleNodeOpenshift
• OCPBUGS-56470 - [release-4.19] OpenShift Console Alert severity icon does not match
• OCPBUGS-56475 - Re-enable pipeline tests with install version as 1.17 (OSP)
• OCPBUGS-56633 - Sometime status.authoritativeAPI stuck in Migrating when changing AuthoritativeAPI from ClusterAPI to MachineAPI
• OCPBUGS-56690 - Release image checks reoccur after exiting from nmtui configuration in install-interactive-disconnected workflow
• OCPBUGS-56764 - Strange interaction with Modals and Drawers
• OCPBUGS-56779 - Fix and enable webterminal e2e in console CI
• OCPBUGS-56780 - [4.19] Expected error logs are not included in insights archive
• OCPBUGS-56798 - [v2] oc mirror - error when mirroring image name ends with the word 'delete'
• OCPBUGS-56806 - TNF: tnf-after-setup- pod timeout
• OCPBUGS-56837 - Developer Getting Started card not shown on Project Overview
• OCPBUGS-56841 - Topology view shows "TypeError: Cannot read properties of null (reading 'metadata')"
• OCPBUGS-56885 - Helm resource list error in console
• OCPBUGS-56890 - [v2] oc-mirror Error: [GenerateReleaseSignatures] no signature found for image
• OCPBUGS-56899 - The dynamic-system-reserved-calc.sh fails if executed only with `true` parameter
• OCPBUGS-56905 - node-image create changes directory permissions
• OCPBUGS-56930 - Component Readiness: [HyperShift] upgrade test regressed
• OCPBUGS-56950 - UI for search by label is distorted in topology
• OCPBUGS-56959 - ginkgo skips testing arm kernelPageSize test suite
• OCPBUGS-56962 - CAPI Providers: should not use v1beta1 of the AdmissionRegistration API group
• OCPBUGS-56967 - [4.20] e2e-aws-ovn-edge-zones is permafailing because of UDN tests permafailing
• OCPBUGS-56969 - [OCP on OSP][DualStack] failed at [sig-network][OCPFeatureGate:RouteExternalCertificate][Feature:Router] test
• OCPBUGS-56970 - RouteExternalCertificate tests fail for HostedControlPlane (KubeVirt)
• OCPBUGS-56978 - ccoctl crashes with nil pointer exception when creating Azure managed identity role assignments that already exist
• OCPBUGS-56987 - [release-4.19] Normal user without project could only see parts of roles list.
• OCPBUGS-56991 - OVE isobuilder fails on CentOS Stream 9 due to missing isoinfo dependency
• OCPBUGS-57020 - Component Readiness: [Networking / cluster-network-operator] [OCPFeatureGate:NetworkDiagnosticsConfig] multiple tests regressed
• OCPBUGS-57030 - 2 port Ordinary clock backport to 4.18
• OCPBUGS-57039 - Installation 4.16 cluster in AWS (self manage) with two master subnets failed at bootstrap phase.
• OCPBUGS-57050 - Need support feature-nfs-export-options for filestore csi driver
• OCPBUGS-57054 - Should show default OpenShift Logo for a theme when there is not custom logo set for the theme.
• OCPBUGS-57086 - [release 4.19] Cherry-picks for Catalog Tests: Fix JUnit format, rename test suite, and enable Catalog Tests for Sippy/TRT integration
• OCPBUGS-57110 - [release-4.19] VirtualizedTable component is breaking if default sort column (sortColumnIndex) is not available
• OCPBUGS-57128 - HorizontalPodAutoscalers via console require CPU resource limit even though HPAs use requests for scaling
• OCPBUGS-57137 - Revert from removing user-assigned identity from Azure ARM template
• OCPBUGS-57149 - E2E: modify RPS test to use 4 cpus for reserved from available cpus
• OCPBUGS-57180 - TargetDown Alert and TOKEN_REVIEW: 'GET /metrics' unauthorized, invalid user token in console pod logs
• OCPBUGS-57185 - Add alert and runbook for PrometheusPossibleNarrowSelectors
• OCPBUGS-57189 - Several [OCPFeatureGate:RouteExternalCertificate] tests are permafailing for periodic-ci-openshift-release-master-nightly-4.19-e2e-agent-single-node-ipv6-conformance
• OCPBUGS-57200 - open Edit Secret modal but didn't change anything will throw error
• OCPBUGS-57208 - AdditionalTrustBundlePolicy still cannot be set in ABI
• OCPBUGS-57265 - Netwoking - Services - Pods : Ellipsis menu missing
• OCPBUGS-57279 - Unnecessary churn with OLMv0 operatorgroup clusterrole management
• OCPBUGS-57283 - Bond-CNI pod failed to recover IPv6 address config after bond interface restart
• OCPBUGS-57284 - [v2] Release signatures errors should stop the workflow during tar generation
• OCPBUGS-57301 - OVE UI build is failing because of outdated mtv-operator
• OCPBUGS-57303 - [e2e auto failure fix] Perma failing tests of e2e-aws-ovn-tls-13
• OCPBUGS-57319 - All import flows should include ?Select or create a project? field
• OCPBUGS-57352 - [release-4.19] high snapshot rate on redhat-operators, OLM operator install hangs. RPC DeadlineExceeded while listing bundles.
• OCPBUGS-57384 - vsphere cloud credentials not syncing correctly
• OCPBUGS-57420 - Bump iso-builder appliance dependency

CVEs

• CVE-2023-40403
• CVE-2025-4802
• CVE-2025-22871
• CVE-2025-31205
• CVE-2025-31257

References

• https://access.redhat.com/security/updates/classification/#important