This advisory addresses two security vulnerabilities in the Jinja2 templating engine used by Red Hat OpenShift Container Platform 4.14. The first vulnerability (CVE-2024-56201) involves a sandbox breakout via malicious filenames, and the second (CVE-2024-56326) involves a sandbox breakout through indirect references to the format method. These flaws could allow an attacker to escape the Jinja2 sandbox restrictions, potentially leading to unauthorized code execution or other security impacts within the affected OpenShift environment. Red Hat has released updated RPM packages and container images as part of OpenShift Container Platform 4.14.46 to fix these issues. Users should upgrade their clusters using the OpenShift CLI or web console following Red Hat's upgrade documentation. The advisory rates the security impact as important, and no CVSS scores are provided in the advisory itself.

The vulnerabilities allow sandbox breakout in the Jinja2 templating engine, which could enable an attacker to bypass sandbox restrictions and potentially execute unauthorized code or perform other malicious actions within the OpenShift Container Platform environment. This impacts the security posture of on-premise or private cloud deployments of OpenShift Container Platform 4.14. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated RPM packages and container images for OpenShift Container Platform 4.14.46 that address these vulnerabilities. Users should upgrade to these updated packages and images as soon as they are available in the appropriate release channel. Upgrades can be performed using the OpenShift CLI (oc) or the web console. Detailed upgrade instructions are available in Red Hat's official documentation. No additional mitigation steps are indicated by the vendor advisory.