This advisory covers two security issues in the Jinja2 templating engine used by Red Hat OpenShift Container Platform 4.13. The first vulnerability (CVE-2024-56201) allows a sandbox breakout through malicious filenames, and the second (CVE-2024-56326) allows a sandbox breakout through indirect reference to the format method. Both vulnerabilities could allow an attacker to escape the Jinja2 sandbox environment. Red Hat has released OpenShift Container Platform 4.13.55 with updated packages and container images that fix these vulnerabilities. The advisory recommends upgrading to these updated versions using the OpenShift CLI or web console.

The vulnerabilities allow sandbox breakout in the Jinja2 templating engine, potentially enabling an attacker to execute unauthorized code or commands outside the intended sandbox environment. This could lead to unauthorized access or control within the OpenShift Container Platform environment. The security impact is rated as important by Red Hat Product Security, and the severity is considered high based on the nature of sandbox escape vulnerabilities.

Red Hat has released fixed packages and container images in OpenShift Container Platform 4.13.55 that address these vulnerabilities. Users should upgrade to version 4.13.55 or later using the OpenShift CLI (oc) or web console as soon as the updates are available in their release channel. Detailed upgrade instructions are provided by Red Hat at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html. No additional mitigations are required beyond applying the official update.