The Red Hat Storage Ceph container images have been updated to version 9.0, incorporating the latest ubi9 base image and Ceph 9.0. This release addresses multiple security vulnerabilities, including CVE-2024-55565 and several CVEs from 2025. The advisory does not specify detailed technical vulnerability descriptions or fixes but provides a new container image for deployment. No known exploits in the wild are reported. The update is distributed as a new container image available via Red Hat's container registry.

The vulnerabilities addressed are rated as high severity by Red Hat Product Security. The specific CVEs include issues related to various CWE categories such as CWE-835 (Loop with Unreachable Exit Condition), CWE-125 (Out-of-bounds Read), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-22 (Path Traversal), CWE-1321 (Improper Handling of Unicode Encoding), and CWE-78 (OS Command Injection). These could potentially allow attackers to cause denial of service, unauthorized data access, or command execution if exploited. However, no known exploits in the wild have been reported at this time.

Red Hat recommends deploying the updated container image rhceph-9.0 available from the Red Hat container registry using the "podman pull" command. This update replaces previous versions and addresses the listed vulnerabilities. No additional patches or fixes are currently provided. Users should update to this new container image to mitigate the vulnerabilities. Patch status is effectively managed by updating to this new container image version.