Red Hat Security Advisory: OpenShift Container Platform 4.15.58 bug fix and security update
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.58. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2025:16158 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/ Security Fix(es): * golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CVE-2024-45337) * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869) * github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog (CVE-2024-45339) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
AI Analysis
Technical Summary
CVE-2024-45337 is a vulnerability in the golang.org/x/crypto/ssh library where misuse of the ServerConfig.PublicKeyCallback callback can lead to authorization bypass. Specifically, if an application or library incorrectly assumes the order or state of public keys during SSH authentication, it may make authorization decisions based on a key for which the attacker does not control the private key. This flaw does not directly allow unauthorized access but introduces a risk if the application logic is insecure. Red Hat OpenShift Container Platform 4.15.58 includes updated container images that fix this and other vulnerabilities. Red Hat has rated this vulnerability as important and advises upgrading to the fixed release. The vulnerability affects versions >=4.15.0 and <4.15.58. Red Hat Enterprise Linux 8 & 9 and some related projects are not affected as they do not call the vulnerable function. No known exploits in the wild have been reported. Mitigation options are limited and do not meet Red Hat's criteria for deployment; thus, upgrading is the recommended solution.
Potential Impact
The vulnerability may allow an attacker to bypass authorization checks in applications that misuse the ServerConfig.PublicKeyCallback during SSH authentication. This could lead to unauthorized privilege escalation or access to sensitive data if the application relies on insecure logic for authorization decisions. However, properly implemented systems that do not misuse this callback remain unaffected. The issue does not directly enable unauthorized access without the presence of insecure application logic. No known active exploitation has been reported.
Mitigation Recommendations
Red Hat advises all OpenShift Container Platform 4.15 users to upgrade to version 4.15.58, which contains the security fixes. There are no effective mitigations that meet Red Hat's criteria for ease of use and applicability; therefore, upgrading is the recommended and supported remediation. Users should follow Red Hat's official upgrade instructions using the OpenShift CLI or web console to apply this update.
Red Hat Security Advisory: OpenShift Container Platform 4.15.58 bug fix and security update
Description
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.58. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2025:16158 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/ Security Fix(es): * golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CVE-2024-45337) * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869) * github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog (CVE-2024-45339) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-45337 is a vulnerability in the golang.org/x/crypto/ssh library where misuse of the ServerConfig.PublicKeyCallback callback can lead to authorization bypass. Specifically, if an application or library incorrectly assumes the order or state of public keys during SSH authentication, it may make authorization decisions based on a key for which the attacker does not control the private key. This flaw does not directly allow unauthorized access but introduces a risk if the application logic is insecure. Red Hat OpenShift Container Platform 4.15.58 includes updated container images that fix this and other vulnerabilities. Red Hat has rated this vulnerability as important and advises upgrading to the fixed release. The vulnerability affects versions >=4.15.0 and <4.15.58. Red Hat Enterprise Linux 8 & 9 and some related projects are not affected as they do not call the vulnerable function. No known exploits in the wild have been reported. Mitigation options are limited and do not meet Red Hat's criteria for deployment; thus, upgrading is the recommended solution.
Potential Impact
The vulnerability may allow an attacker to bypass authorization checks in applications that misuse the ServerConfig.PublicKeyCallback during SSH authentication. This could lead to unauthorized privilege escalation or access to sensitive data if the application relies on insecure logic for authorization decisions. However, properly implemented systems that do not misuse this callback remain unaffected. The issue does not directly enable unauthorized access without the presence of insecure application logic. No known active exploitation has been reported.
Mitigation Recommendations
Red Hat advises all OpenShift Container Platform 4.15 users to upgrade to version 4.15.58, which contains the security fixes. There are no effective mitigations that meet Red Hat's criteria for ease of use and applicability; therefore, upgrading is the recommended and supported remediation. Users should follow Red Hat's official upgrade instructions using the OpenShift CLI or web console to apply this update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:16160
- Cve Count
- 3
- Additional Cves
- ["CVE-2024-45339","CVE-2025-22869"]
Threat ID: 6a160975e29bf47b506400e6
Added to database: 05/26/2026, 20:58:29 UTC
Last enriched: 08/14/2026, 22:26:31 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 109
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.