Red Hat OpenShift Container Platform 4 vulnerabilities
255 known vulnerabilities in Red Hat OpenShift Container Platform 4 from Red Hat. 255 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.9 High severity
Red Hat Enterprise Linux 10: Exposure of Private Personal Information to an Unauthorized Actor
A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type G
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in
- 8.3 High severity
Assisted Installer for Red Hat OpenShift…: Missing Authentication for Critical Functionality
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit
- 7.1 High severity
Red Hat OpenShift Container Platform 4: Exposure of Information Through Directory Listing
A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML direc
- 7.4 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause
- 7.5 High severity
Red Hat Enterprise Linux 10: Loop with Unreachable Exit Condition
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a han
- 8.1 High severity
Samba: Improper Handling of Case Sensitivity
An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a
- 7.4 High severity
Red Hat Enterprise Linux 10: Insufficient Verification of Data Authenticity
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Argument Delimiters in a Command
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly san
- 8.5 High severity
Red Hat Ansible Automation Platform 2.6: Improper Neutralization of Special Elements Used in a Template Engine
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitizat
- 8.8 High severity
Red Hat Enterprise Linux 10: Time-of-check Time-of-use (TOCTOU) Race Condition
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
- 8.2 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
- 7.8 High severity
Red Hat Enterprise Linux 10: Concurrent Execution using Shared Resource with Improper Synchronization
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
- 8.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can und
- 9.3 Critical severity
Red Hat Build of Podman Desktop: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbit
- 8.8 High severity
Migration Toolkit for Applications 8: Improper Link Resolution Before File Access
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and
- 7.5 High severity
Red Hat Enterprise Linux 10: Heap-based Buffer Overflow
A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size whe
- 8.1 High severity
Red Hat Enterprise Linux 10: Comparison Using Wrong Factors
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same
- 7.0 High severity
Red Hat Enterprise Linux 10: Expired Pointer Dereference
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit
- 8.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data,
- 7.2 High severity
Red Hat OpenShift Container Platform 4.17: Unintended Proxy or Intermediary
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send req
- 7.5 High severity
Red Hat Enterprise Linux 10: Uncontrolled Resource Consumption
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in u
- 7.7 High severity
Red Hat Enterprise Linux 8: Integer Overflow or Wraparound
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application ins
- 7.4 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-cont
- 7.4 High severity
Red Hat OpenShift Container Platform 4.18: Improper Verification of Cryptographic Signature
A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote a
- 8.8 High severity
Confidential Compute Attestation: Execution with Unnecessary Privileges
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and sec
- 8.0 High severity
Red Hat OpenShift Container Platform 4: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perf
- 8.2 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset
- 7.4 High severity
Red Hat Ansible Automation Platform 2.6 for…: Improper Verification of Cryptographic Signature
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the ba
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Privilege Management
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in c
- 7.5 High severity
Red Hat Enterprise Linux 10: Partial String Comparison
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An atta
- 8.5 High severity
Red Hat Enterprise Linux 10: Release of Invalid Pointer or Reference
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free
- 7.5 High severity
Red Hat Enterprise Linux 10: Heap-based Buffer Overflow
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent att
- 7.8 High severity
Red Hat Enterprise Linux 10: Time-of-check Time-of-use (TOCTOU) Race Condition
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to
- 7.0 High severity
Red Hat Hardened Images: Improper Link Resolution Before File Access
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted
- 7.9 High severity
Red Hat Enterprise Linux 10: Missing Release of File Descriptor or Handle after Effective Lifetime
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the
- 7.1 High severity
Red Hat Enterprise Linux 10: Incorrect Authorization
NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connec
- 8.1 High severity
Red Hat OpenShift Container Platform 4: External Control of File Name or Path
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitra
- 7.8 High severity
vim: Improper Control of Generation of Code
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell comman
- 9.9 Critical severity
Multicluster Global Hub 1.4.9: Incorrect Authorization
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker t