This advisory addresses two security vulnerabilities in the Jinja2 template engine used by Red Hat OpenShift Container Platform 4.14. The first vulnerability (CVE-2024-56201) allows a sandbox breakout through malicious filenames. The second vulnerability (CVE-2024-56326) allows a sandbox breakout through indirect reference to the format method. Both vulnerabilities could potentially allow an attacker to escape the sandbox restrictions imposed by Jinja2, leading to unauthorized code execution or other impacts. The vulnerabilities are fixed in OpenShift Container Platform version 4.14.46. The advisory recommends upgrading to this version to apply the fixes.

The vulnerabilities allow sandbox breakout in the Jinja2 template engine, which could lead to unauthorized code execution or compromise of the application environment running OpenShift Container Platform 4.14 prior to version 4.14.46. The security impact is rated as important/high by Red Hat Product Security. No known exploits in the wild have been reported at the time of this advisory.

A fix is available in Red Hat OpenShift Container Platform version 4.14.46. Users should upgrade to this version using the OpenShift CLI or web console as soon as the updated packages and images are available in their release channel. Detailed upgrade instructions are provided by Red Hat in their official documentation. No additional mitigation steps are indicated beyond applying the update.