This advisory covers security updates for Red Hat OpenShift Container Platform 4.16 and 4.18. The key vulnerability CVE-2024-11218 involves a container breakout caused by a race condition when using the --jobs=2 option in buildah during container image builds, allowing potential escape from container isolation. Additional vulnerabilities include an out-of-bounds write in grub2's network configuration file search function (CVE-2025-0624) and a memory allocation issue in the golang-jwt/jwt library during JWT header parsing (CVE-2025-30204). These vulnerabilities have been addressed in OpenShift Container Platform 4.16.33 and 4.18.8 releases through updated container images and RPM packages. Red Hat provides official advisories and upgrade documentation to apply these fixes.

Successful exploitation of CVE-2024-11218 could allow an attacker to break out of container isolation, potentially leading to unauthorized access to the host system. The grub2 out-of-bounds write (CVE-2025-0624) could cause memory corruption, potentially leading to denial of service or code execution. The golang-jwt/jwt vulnerability (CVE-2025-30204) allows excessive memory allocation, which could be exploited to cause denial of service. These vulnerabilities collectively pose a high security risk to affected OpenShift Container Platform deployments if left unpatched.

Red Hat has released official fixes for these vulnerabilities in OpenShift Container Platform versions 4.16.33 and 4.18.8. Users should upgrade their clusters to these versions or later as soon as updates are available via the appropriate release channels. Upgrade instructions are provided by Red Hat and can be performed using the OpenShift CLI (oc) or web console. No additional mitigations are required beyond applying these official patches.