This advisory addresses two security vulnerabilities in the go-git library used by Red Hat OpenShift Container Platform 4.16. The first vulnerability (CVE-2025-21613) involves argument injection through the URL field, classified under CWE-88 (Argument Injection or Modification). The second vulnerability (CVE-2025-21614) allows denial-of-service attacks via maliciously crafted Git server replies, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). These vulnerabilities affect OpenShift Container Platform 4.16 versions from 4.16.0 up to but not including 4.16.36. Red Hat has released updated RPM packages and container images in version 4.16.36 to fix these issues. No known exploits in the wild have been reported. The vendor rates the security impact as Important (high severity).

The vulnerabilities could allow an attacker to perform argument injection via the URL field, potentially leading to unintended command execution or manipulation within the go-git client. Additionally, the denial-of-service vulnerability could allow an attacker to disrupt service by sending maliciously crafted Git server replies to go-git clients. These issues impact the stability and security of OpenShift Container Platform 4.16 deployments using the affected go-git versions.

Red Hat has released OpenShift Container Platform 4.16.36, which includes fixes for these vulnerabilities. Users should upgrade to version 4.16.36 using the OpenShift CLI (oc) or web console as soon as the update is available in their release channel. Detailed upgrade instructions are provided by Red Hat at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html. No additional mitigations are indicated by the vendor advisory.