RHSA-2025:22257MediumCVSS 6.5

Red Hat Security Advisory: OpenShift Container Platform 4.20.6 bug fix and security update

Published
December 2, 2025
Last Modified
August 17, 2026

🔗 CVE IDs covered (2)

CVE-2025-55198 →CVE-2025-55199 →

📋 Description

CVE-2025-55198 — helm.sh/helm/v3: Helm YAML Parsing Panic Vulnerability CVE-2025-55199 — helm.sh/helm/v3: Helm Chart JSON Schema Denial of Service

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:4d58d52aba540f985f2626485a8d05cb5b89436907168ad298911b6bbc020db0_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:4f88c8185d435e1b9d1bcd162ca92e70fef883971ca4d5a571289a7427da4928_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:7b02564d95e5ee8fc1b23234a27de5f7fbbf7b49124d61990ec76c947ddb06bc_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:a88c5f20ef71cf223842f164bb929732401055c33bdd9b4283226858d42e170b_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:12fad6f056ca4454c290cd6d5be1061baeddb9187c642525bdebf9a4194bd8fd_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:145914b65c1386777211a40453b306a880b28e73fe9b7d9252103d53cc7dcac0_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:8636f1384ff9ee22148213b1309284f562c825cdbb86a17c1d2a42b7c8253829_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:f9dd3734920a00bbe183e5d38847de767516f3ca106b464a6993058441d62c21_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:02f160c5ca6b4ce8c6edba3a8eb31b5767b748fb919fb827f64e6aa6c17d49fc_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8302497b61ae80864f37a3d882d93371258fd1bad803fd2d5f05eed10703dc68_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:abdef5c413cd2dae058830772b4e9d7d3f9da54ca8e1330eccc6706cb924a8f9_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f6814febfc9b0d6fc58c505451c408f3246c54a9c256907956d720c52f4a6e2a_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:0e8ef547bfe2258a109db272a1ff72d664a1ec0aa281c7b41c1ddb124f6833c6_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:19240e907a2f1c05b05f67ccfa0e51985514ed19c2911bc9989f5cc9ce10f347_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:632c66dd6ca3308a774c4e7f6fa5d5c1adfd261c24dd420e5354cd5b65ede16e_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:fb6255c5c5cc5de9ec3e2ee42daee16e288aecc9ff47e7242693c6b686c17ef0_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:4590b36599eb4733fa470e6543fca9adab3fb0f9bfea60540dc825f750cd9e7a_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5a20e5dccdcff6df92e2438ee8c5fe0302b1a0d7ee78378c6076f5b53a1bc012_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:82af2b1029638f40aece7c7fad386ba94e1a07603a1680dd636b80afe608f2ac_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e9ea1d49cec675a19474cdfb442241185f9322638ad61d0fadd7d34d5f9a6c77_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:186408257742e57c32d8c678fea64306a84f9597d3ae9f992239991ea92a4a76_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:1c17b16c85ca99ebd29d6821c1137156fe4ff457695fda5e4a0a82bf7b45c091_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5d3315fa35947fa6e6643e7a967398d05198ff0978d6277a36f8916d05fadf1d_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:73908c4d306a902c2d6a8547b0a9555ebc550ad8835c6655e601eb4f46cacc57_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:175ff2f5faa16148964acf3bf7ca56b4cbcf919e53063d88c471fb98d6d60709_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:52dd511719036e033454657d9e4fac1e78d8e4b09d259ac9ea81af8213343dc0_ppc64le as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:62894de71c6a9a336af43bed7a8532046beaf415aa42c2e74bdd9ae7bae3367b_arm64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ad04c1854b1062fbb0f1b57de239cbdd67b4eb946a6137b4ff73a5fbf0afa867_amd64 as a component of Red Hat OpenShift Container Platform 4.2
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:35c8e9a0b84074238a8d1c6e59f7e3ee1f1ccca2774921b530a2fad828fd6c5c_s390x as a component of Red Hat OpenShift Container Platform 4.2
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:a29bcbc9f286d68b394ffa0288c5de7e487c90077c06cbaf7a4cadeb0398ce28 (For s390x architecture) The image digest is sha256:724ea94541fa32defeae6a782fb2f1194e5bd7221ec33d7bcc6c4dc1e53cabc3 (For ppc64le architecture) The image digest is sha256:125ba716fa99fd8dbf33a8407030ad06704cd394dfc4898f7d6fb69e1bc9a8cd (For aarch64 architecture) The image digest is sha256:38a6732d5a3485f145657156e3c0625c21aa0af16c49959dd97eec75bfb1706e All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this flaw, ensure YAML files are formatted as Helm expects prior to processing them with Helm. Workaround: To mitigate this flaw, ensure all Helm charts do not have any reference of $ref pointing to /dev/zero.

🔗 References (5)