Red Hat Security Advisory: OpenShift Container Platform 4.17.35 bug fix and security update
Red Hat OpenShift Container Platform 4. 17. 35 includes several security fixes addressing vulnerabilities such as overwriting node pull credentials during the build process (CVE-2024-45497), unexpected memory consumption in token parsing (CVE-2025-22868), incorrect library search in static setuid binaries (CVE-2025-4802), and HTTP request smuggling due to invalid chunked data acceptance (CVE-2025-22871). These issues affect on-premise or private cloud deployments of OpenShift Container Platform 4. 17. Users are advised to upgrade to the updated packages and container images available through the official release channels to mitigate these vulnerabilities.
AI Analysis
Technical Summary
This advisory covers Red Hat OpenShift Container Platform 4.17.35, which addresses multiple security vulnerabilities. Notably, CVE-2024-45497 allows overwriting of node pull credentials during the build process in the openshift-controller-manager, potentially impacting credential integrity. CVE-2025-22868 involves unexpected memory consumption during token parsing in the golang.org/x/oauth2/jws package. CVE-2025-4802 concerns incorrect searching of LD_LIBRARY_PATH by static setuid binaries using dlopen in glibc. CVE-2025-22871 is a request smuggling vulnerability in net/http due to acceptance of invalid chunked data. The advisory recommends upgrading to the fixed container images and RPM packages for OpenShift Container Platform 4.17.35. The vendor rates the security impact as Important (high severity). No CVSS scores are provided in the advisory; users should refer to individual CVE pages for detailed scoring.
Potential Impact
The vulnerabilities fixed in this update could allow unauthorized overwriting of node pull credentials, leading to potential credential compromise. Memory consumption issues during token parsing could affect service stability. Incorrect library path searching in setuid binaries may lead to unintended library loading, potentially escalating privileges. The HTTP request smuggling vulnerability could allow attackers to bypass security controls or interfere with HTTP request processing. These issues collectively pose a high security risk to affected OpenShift Container Platform 4.17 deployments if left unpatched.
Mitigation Recommendations
Red Hat has released updated container images and RPM packages as part of OpenShift Container Platform 4.17.35 that address these vulnerabilities. Users should upgrade their OpenShift clusters using the OpenShift CLI (oc) or web console as soon as the updates are available in their release channels. Detailed upgrade instructions are provided by Red Hat at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. No alternative mitigations or workarounds are indicated in the vendor advisory. Patch status is confirmed as fixed in this release.
Red Hat Security Advisory: OpenShift Container Platform 4.17.35 bug fix and security update
Description
Red Hat OpenShift Container Platform 4. 17. 35 includes several security fixes addressing vulnerabilities such as overwriting node pull credentials during the build process (CVE-2024-45497), unexpected memory consumption in token parsing (CVE-2025-22868), incorrect library search in static setuid binaries (CVE-2025-4802), and HTTP request smuggling due to invalid chunked data acceptance (CVE-2025-22871). These issues affect on-premise or private cloud deployments of OpenShift Container Platform 4. 17. Users are advised to upgrade to the updated packages and container images available through the official release channels to mitigate these vulnerabilities.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers Red Hat OpenShift Container Platform 4.17.35, which addresses multiple security vulnerabilities. Notably, CVE-2024-45497 allows overwriting of node pull credentials during the build process in the openshift-controller-manager, potentially impacting credential integrity. CVE-2025-22868 involves unexpected memory consumption during token parsing in the golang.org/x/oauth2/jws package. CVE-2025-4802 concerns incorrect searching of LD_LIBRARY_PATH by static setuid binaries using dlopen in glibc. CVE-2025-22871 is a request smuggling vulnerability in net/http due to acceptance of invalid chunked data. The advisory recommends upgrading to the fixed container images and RPM packages for OpenShift Container Platform 4.17.35. The vendor rates the security impact as Important (high severity). No CVSS scores are provided in the advisory; users should refer to individual CVE pages for detailed scoring.
Potential Impact
The vulnerabilities fixed in this update could allow unauthorized overwriting of node pull credentials, leading to potential credential compromise. Memory consumption issues during token parsing could affect service stability. Incorrect library path searching in setuid binaries may lead to unintended library loading, potentially escalating privileges. The HTTP request smuggling vulnerability could allow attackers to bypass security controls or interfere with HTTP request processing. These issues collectively pose a high security risk to affected OpenShift Container Platform 4.17 deployments if left unpatched.
Mitigation Recommendations
Red Hat has released updated container images and RPM packages as part of OpenShift Container Platform 4.17.35 that address these vulnerabilities. Users should upgrade their OpenShift clusters using the OpenShift CLI (oc) or web console as soon as the updates are available in their release channels. Detailed upgrade instructions are provided by Red Hat at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. No alternative mitigations or workarounds are indicated in the vendor advisory. Patch status is confirmed as fixed in this release.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:10294
- Cve Count
- 4
- Additional Cves
- ["CVE-2025-4802","CVE-2025-22868","CVE-2025-22871"]
- Cvss Version
- null
Threat ID: 6a160976e29bf47b50640a07
Added to database: 5/26/2026, 8:58:30 PM
Last enriched: 5/26/2026, 11:48:36 PM
Last updated: 5/27/2026, 4:58:46 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.