Red Hat Product Errata RHSA-2026:80684 - Security Advisory
Issued:
2026-10-12
Updated:
2026-10-12

RHSA-2026:80684 - Security Advisory

Synopsis

Updated Red Hat OpenStack Platform 17.1 director Operator container images

Type/Severity

Security Advisory: Important

Topic

Updated container images are now available for director Operator for Red Hat OpenStack Platform 17.1 (Wallaby) for RHEL 9.2.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

The Red Hat OpenStack Platform (RHOSP) director Operator adds the ability to install and run a RHOSP cloud within OpenShift Container Platform (OCP).

Security Fixes:

  • golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
  • Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  • Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  • Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
  • golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
  • Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
  • golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
  • Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  • Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
  • golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Enhancements:

  • This release of OSPdO includes support for installation on OpenShift 4.20 platform (RHOSSTRAT-1291)

Bug Fixes:

  • osp-director-operator no longer depends on the deprecated kube-rbac-proxy image (OSPRH-25893)

Solution

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io or registry.access.redhat.com using the 'podman pull' command.

For more information about the images, search the image name in the Red Hat Ecosystem Catalog.

Affected Products

  • Red Hat OpenStack

Fixes

  • RHOSSTRAT-1291 - Enable deployment of OSPdO on OpenShift Version 4.20

amd64

registry.redhat.io/rhosp-rhel9/osp-director-agent@sha256:6137209995c857c10d1b7d55eafaa32dd14fef224f575e71f912eab28a76bbbb
registry.redhat.io/rhosp-rhel9/osp-director-downloader@sha256:b4a5620ca7a228bd175b53a1dd8116b47bfb16460c628318382feeeb46c7bee9
registry.redhat.io/rhosp-rhel9/osp-director-operator-bundle@sha256:6baa13d985ef1ff6f08399cc2ef04832e23982472bfdede2a7acd9a4b559c637
registry.redhat.io/rhosp-rhel9/osp-director-operator@sha256:c451fd722d0eed3d2a416fe66d9852310b585e7fa7cacb24675a6c06ee30d9d6

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.