Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update

CVE-2025-47907 is a race condition vulnerability in the database/sql package that can cause unexpected results when a query is cancelled during a Scan method call on returned Rows. This concurrency issue allows an attacker who can initiate and cancel queries to trigger inconsistent data being returned to the application. The vulnerability is identified as CWE-362 (race condition) and CWE-444. Red Hat has rated the security impact as moderate and provided updated packages and container images for OpenShift Container Platform 4.20.2 to fix the issue. The flaw primarily impacts applications that cancel queries while running multiple queries concurrently and requires no privileges or user interaction to exploit. The CVSS vector from Red Hat is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L with a base score of 7.0.

The vulnerability can lead to inconsistent or unexpected data being returned by database queries when they are cancelled concurrently. This may cause application instability or incorrect behavior but is unlikely to result in direct compromise or privilege escalation in typical deployments. The race condition could also cause denial of service through resource exhaustion or crashes in some scenarios. The impact is limited to applications that perform concurrent query cancellations.

Red Hat has released official security updates for affected products, including OpenShift Container Platform 4.20.2. Users should upgrade to these updated packages and container images via the appropriate release channels using the OpenShift CLI or web console. Detailed upgrade instructions are available in Red Hat's documentation. No additional mitigations are specified or required beyond applying the official fixes.