{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "An update for ibu components is available for Red Hat OpenShift Container Platform 4.22.",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\nThis advisory contains the extra ibu container images for Red Hat OpenShift Container Platform 4.22. All OpenShift Container Platform users are advised to upgrade to these updated packages and images.",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:95053",
      "url" : "https://access.redhat.com/errata/RHSA-2026:95053"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-84445",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-84445"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/",
      "url" : "https://access.redhat.com/security/updates/classification/"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95053.json"
    } ],
    "title" : "Red Hat Security Advisory: OpenShift Container Platform 4.22 CNF IBU extras update",
    "tracking" : {
      "current_release_date" : "2026-11-07T14:47:52+00:00",
      "generator" : {
        "date" : "2026-11-07T14:47:52+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.4.5"
        }
      },
      "id" : "RHSA-2026:95053",
      "initial_release_date" : "2026-11-04T08:08:32+00:00",
      "revision_history" : [ {
        "date" : "2026-11-04T08:08:32+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-11-04T08:08:40+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-11-07T14:47:52+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat OpenShift Container Platform 4.22",
          "product" : {
            "name" : "Red Hat OpenShift Container Platform 4.22",
            "product_id" : "Red Hat OpenShift Container Platform 4.22",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:openshift:4.22::el9"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat OpenShift Container Platform"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64",
          "product" : {
            "name" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64",
            "product_id" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/lifecycle-agent-rhel9-operator@sha256%3Aabd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651?arch=amd64&repository_url=registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator&tag=1793174485"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64",
          "product" : {
            "name" : "registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64",
            "product_id" : "registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/lifecycle-agent-operator-bundle@sha256%3Acfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70?arch=amd64&repository_url=registry.redhat.io/openshift4/lifecycle-agent-operator-bundle&tag=1793258719"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64",
          "product" : {
            "name" : "registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64",
            "product_id" : "registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/recert-rhel9@sha256%3A275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2?arch=amd64&repository_url=registry.redhat.io/openshift4/recert-rhel9&tag=1793253732"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "amd64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64",
          "product" : {
            "name" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64",
            "product_id" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/lifecycle-agent-rhel9-operator@sha256%3Af2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b?arch=arm64&repository_url=registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator&tag=1793174485"
            }
          }
        }, {
          "category" : "product_version",
          "name" : "registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64",
          "product" : {
            "name" : "registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64",
            "product_id" : "registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/recert-rhel9@sha256%3Abd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa?arch=arm64&repository_url=registry.redhat.io/openshift4/recert-rhel9&tag=1793253732"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "arm64"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64 as a component of Red Hat OpenShift Container Platform 4.22",
        "product_id" : "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64"
      },
      "product_reference" : "registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64",
      "relates_to_product_reference" : "Red Hat OpenShift Container Platform 4.22"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64 as a component of Red Hat OpenShift Container Platform 4.22",
        "product_id" : "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64"
      },
      "product_reference" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64",
      "relates_to_product_reference" : "Red Hat OpenShift Container Platform 4.22"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64 as a component of Red Hat OpenShift Container Platform 4.22",
        "product_id" : "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64"
      },
      "product_reference" : "registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64",
      "relates_to_product_reference" : "Red Hat OpenShift Container Platform 4.22"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64 as a component of Red Hat OpenShift Container Platform 4.22",
        "product_id" : "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64"
      },
      "product_reference" : "registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64",
      "relates_to_product_reference" : "Red Hat OpenShift Container Platform 4.22"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64 as a component of Red Hat OpenShift Container Platform 4.22",
        "product_id" : "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64"
      },
      "product_reference" : "registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64",
      "relates_to_product_reference" : "Red Hat OpenShift Container Platform 4.22"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-84445",
    "cwe" : {
      "id" : "CWE-125",
      "name" : "Out-of-bounds Read"
    },
    "discovery_date" : "2026-09-14T16:22:17.356407+00:00",
    "flags" : [ {
      "label" : "vulnerable_code_not_present",
      "product_ids" : [ "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64" ]
    } ],
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2533175"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "This vulnerability is rated as an Important severity impact because an unauthenticated remote client can crash the host daemon, causing an immediate denial of service across exposed endpoints. The issue specifically threatens deployments utilizing xDS-managed gRPC servers, as requests that omit standard routing authority parameters cause the application to crash on an unhandled slice lookup. Standard gRPC server implementations that do not configure xDS control plane routing are not susceptible to this failure mode. Furthermore, in environments enforcing mutual transport layer security (mTLS), successful transport authentication is required before reaching the vulnerable routing stage, restricting potential exploitation to authenticated peers.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64" ],
      "known_not_affected" : [ "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-84445"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2533175",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-84445",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-84445"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84445",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
      "url" : "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
      "url" : "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
      "url" : "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/issues/9354",
      "url" : "https://github.com/grpc/grpc-go/issues/9354"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/pull/9365",
      "url" : "https://github.com/grpc/grpc-go/pull/9365"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/pull/9366",
      "url" : "https://github.com/grpc/grpc-go/pull/9366"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/pull/9367",
      "url" : "https://github.com/grpc/grpc-go/pull/9367"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
      "url" : "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
      "url" : "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
    }, {
      "category" : "external",
      "summary" : "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
      "url" : "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
    } ],
    "release_date" : "2026-09-14T16:11:41.401000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-11-04T08:08:32+00:00",
      "details" : "For OpenShift Container Platform 4.22, see the following documentation for important instructions about upgrading your cluster and applying this asynchronous errata update:\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/index\nInformation about accessing this content is available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli",
      "product_ids" : [ "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:95053"
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "HIGH",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "NONE",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "version" : "3.1"
      },
      "products" : [ "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-operator-bundle@sha256:cfe0c64525dc1ad95e53f621fd0fb8c1f3554b8df6c202e8c9b3f115583a4f70_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:abd2c454b3af68887af3f2a188394e25192b1f99c1fa9a0b37542d091a5a1651_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator@sha256:f2c52943678a6027c11764cf80d2121d7d42d23f5cdb4e31099af959d23b616b_arm64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:275bc38edc5eef34811a967e30ce3bf49555c1576e76765655018518a79060d2_amd64", "Red Hat OpenShift Container Platform 4.22:registry.redhat.io/openshift4/recert-rhel9@sha256:bd5a8580b1db4ae98c44ff5842134b93b0769b92689c423c01dd8edcbffd30aa_arm64" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests"
  } ]
}