RHSA-2025:3297HighCVSS 7.8

Red Hat Security Advisory: OpenShift Container Platform 4.17.23 bug fix and security update

Published
April 3, 2025
Last Modified
August 2, 2026

🔗 CVE IDs covered (3)

CVE-2024-8676 →CVE-2025-0624 →CVE-2025-24928 →

📋 Description

CVE-2024-8676 — cri-o: Checkpoint restore can be triggered from different namespaces CVE-2025-0624 — grub2: net: Out-of-bounds write in grub_net_search_config_file() CVE-2025-24928 — libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:5e7fe7cbab4dd8448f48a81d3e8885c7e0689926e538f9f260bd818f792e62bb_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:a805bfb33f94dec8800aa0d3dbccfd0bf9efa71b3aacd9795fdddff49cb04768_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:f268ef3cc7ba16f0e32d132a0073ca6b77ca44a3d1c791ba414ef4cf8b8eb2d5_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:f7ee1be134805453b2a4be43582bc0b636eb874c25f9afcad5988b66265c71c0_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:0b880296331ba579e6968ec7a31660685e173439011b8df34479a2cb55b80c06_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:1670250ce4dca7bf890c050370afc4c57f6af9ccd1004f143d373a60f563aa43_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:3166367fb264ee87b758e65ea172756bf3040042c4418eed67b78822e040c4e7_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:cde3bed286dd26ba6443ea553a827ad1d2a27ebb1e3b8901a2b04bc3f9880af1_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:09c440a57b2cd7d7f23faa3dffb5574723a16a6a0e1f7c3657d93751c70224d4_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:2cbf79edaf3546571c8bd7fca828c1e3b3c0193c5d06b0022840144dd65e4af9_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:55bf60d65f5b498155e8e3086f6656a56d9767e08e1ac276d38e71be332c6287_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/cloud-network-config-controller-rhel9@sha256:b52946437bf63227a8dd9b22b069e61a9fa0bb9a5e4be7f5cedf3f55c4ec35cc_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:43148395076f93776886ff5bf4e61f572f2add2b16229914c493a2b6149507da_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:8945593b85c25382dcaee00e00938e79eb9f598cb35c5b7317c76cd7cab17930_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:a61c975cadf9e1085e66ff30e83a0ee4854f5377ed03f4d6433c497c7fd90a45_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:de96777495f27094cea8d11ca332809a712a4437161d73e3358b64c7d0b42ea0_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:86dd2cef542888f1e2562d76afe7e8f79b0e628c6814a069849ccb437c5601d8_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:91a5dc7edb4c8c278c3184486afa19cc29c1737ab76177b17239ba6b3673bebe_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:c857b54ee3dcac08d50114b4ceb464212e43ae724cdfc8e70ac59d599e212ae9_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/driver-toolkit-rhel9@sha256:c8a94b8b9719cdb69c91b2db5c2cff8550ab334a91b174cafe1813cb860af0c0_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:09c5c2313e1a5028061778b8bf3594eb3766500dc16c719df608432de18e47e3_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:318bcdb853f83a43563be42b3ffe5c8670a693ebc95fe16167779969d3581a55_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:53ab3d5f788e01fe27209baf11b7ea6d00f1d924a08b4d0df00e3e7610e7ee65_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/egress-router-cni-rhel9@sha256:b16869e16b59feeaa1e2646763dbf9328813099fd3b06030f112545628cb8d14_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:12b91d165f630be52c1cebd2ce1ff701ef0acd37b536feffac1dc6f721b05c66_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:97aec9d44c8bd08fa7a85e7ac54f340962f33b6fd64b250905ad63ed40e30ad4_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:ba8b35f35d9d5af99964dc705043e38945592c949d731195efc8d37851363e2f_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/frr-rhel9@sha256:be6c8b56f0bb2bdad5536a8d8ae7a91b99bd7266d21cea036c898c9e521e5376_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • openshift4/kube-metrics-server-rhel9@sha256:172647bc2f3b2244583d70d64986013ed073faaa6f94bfae5fd566df8b503039_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:7e8b4557c0a15765440c543ab50cd591bb94f0745c20564e5f15d57bf5f76a82 (For s390x architecture) The image digest is sha256:dd3148c37d8b4122f500ae1bb92e29e34d1cc3bfa634d5c53a9f8528945abd2d (For ppc64le architecture) The image digest is sha256:04bf2f5c15417eeb7de26d95de767b62ce263d5cc99400cbaa4d370c5007ab18 (For aarch64 architecture) The image digest is sha256:b491dcca8f5a2fe177f628f661a23086497440cf9b994638b199b9299335741b All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (14)