RHSA-2026:4936 - Security Advisory

Topic

Red Hat OpenStack Services on OpenShift (RHOSO) 18.0.17 containers are now available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenStack Services on OpenShift is a hybrid cloud solution
for deploying and managing virtualized and containerized applications in a
scalable infrastructure with a Red Hat OpenShift Container Platform (RHOCP)
control plane.

Security Fix(es):

• golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
• archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update as a new RHOSO 18.0 deployment, see “Deploying Red Hat OpenStack Services on OpenShift” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/deploying_red_hat_openstack_services_on_openshift/index

For details on how to apply this update to an existing RHOSO 18.0 deployment, see “Updating your environment to the latest maintenance release” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index

Fixes

• RHOSSTRAT-1102 - GA - Support Data plane adoption for BGP control plane
• RHOSSTRAT-1040 - Support Ceph 9 Release in RHOSO-18 (Ceph Storage)
• RHOSSTRAT-1006 - Enable Chargeback in RHOSO Generally Available
• RHOSSTRAT-1003 - Migrate iscsid and multipathd from containers to EDPM host for RHEL supportability
• RHOSSTRAT-971 - Add support for RHEL 9.6 in the DataPlane
• RHOSSTRAT-946 - Proteccio HSM Adoption
• RHOSSTRAT-683 - Cinder-FC Adoption Graduate to Full Support
• RHOSSTRAT-616 - RHOSO DCN with Storage Adoption
• RHOSSTRAT-167 - Octavia Adoption
• OSPRH-27098 - [uni06zeta-rhel9-rhoso18.0] - EDPM swift deployment fails with template container_defs/rsync.yaml.j2 not found
• OSPRH-27070 - [uni06zeta-rhel9-rhoso18.0] - EDPM Bootstrap Failure: FIPS status inconsistent on compute nodes
• OSPRH-26079 - Request bugfix of hugepage reboot
• OSPRH-25715 - Tune worker processes number inside the pod service depending on the scale
• OSPRH-25612 - Exclude empty dataplane nodeset during minor update
• OSPRH-25533 - Removing a data plane node from a NodeSet leaves orphan certificates
• OSPRH-25409 - Coverage metrics not emitting zero when absent from ovs coverage/show
• OSPRH-24869 - IPv6 not supported for baremetal node provisioning
• OSPRH-23846 - [18.0.14] unable to create new image HTTP 500 Internal Server Error
• OSPRH-23737 - The template for metrics.yaml for CloudKitty is wrong in telemetry-operator
• OSPRH-23165 - Warnings about northd and ovndbs on network exporter logs
• OSPRH-23113 - multipathd and edpm_multipathd services are running
• OSPRH-23103 - Enable in-place update workflow for non-OVN network providers
• OSPRH-23072 - Missing memcache certs in Swift storage
• OSPRH-22602 - Autoscaling controller doesn't react to related secret changes correctly
• OSPRH-22598 - Missing topologyRef for mysqld-exporter and kube-state-metrics
• OSPRH-22596 - service: metricStorage label is leaking into other controllers
• OSPRH-21550 - Improve services rabbitmq failover behavior when one worker is down
• OSPRH-21020 - RHOSO Telemetry rabbitmq is scraping only one rabbitmq node instead of all nodes from cluster
• OSPRH-20796 - Redis unable to start in IPv6 single stack cluster
• OSPRH-20217 - How to Mask LVMs in cinder volumes on EDPM nodes
• OSPRH-20083 - frrconfiguration CRs needed to expose octavia-hmport-map and designate configmaps IPs
• OSPRH-17961 - NodeSet reconcile not triggered on changes to ConfigMaps and Secrets from ansibleVarsFrom
• OSPRH-14548 - Develop how to configure http/https proxy on edpm nodes when e.g. podman must use one
• OSPRH-14309 - Automatically set s3_store_cacert in glance-operator
• OSPRH-8984 - Improve raising the route status

CVEs

• CVE-2025-58183
• CVE-2025-61729

References

• https://access.redhat.com/security/updates/classification/
• https://catalog.redhat.com/software/containers/search