This advisory covers security fixes in Red Hat OpenShift Container Platform 4.19.0 for four vulnerabilities: CVE-2024-45337 (authorization bypass due to misuse of ServerConfig.PublicKeyCallback in golang.org/x/crypto/ssh), CVE-2024-45338 (non-linear parsing of case-insensitive content in golang.org/x/net/html), CVE-2025-22868 (unexpected memory consumption during token parsing in golang.org/x/oauth2/jws), and CVE-2025-22869 (denial of service in the key exchange of golang.org/x/crypto/ssh). These vulnerabilities affect the underlying Go libraries used by OpenShift and could impact the security and stability of the platform. The advisory includes RPM package updates and container image updates to address these issues.

The vulnerabilities may allow an attacker to bypass authorization checks, cause denial of service, or trigger unexpected memory consumption, potentially impacting the availability and security of the OpenShift Container Platform 4.19 deployments. The issues affect critical components related to SSH, HTML parsing, and OAuth2 token handling within the platform's dependencies. Red Hat rates the security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated RPM packages and container images for OpenShift Container Platform 4.19.0 that address these vulnerabilities. Users are advised to upgrade to these updated packages and images through the appropriate release channels using the OpenShift CLI or web console. Detailed upgrade instructions are available in Red Hat's official documentation. Since this is an official security advisory with fixes available, applying these updates is the recommended mitigation.