The Red Hat OpenShift Container Platform 4.14.53 release contains security fixes including CVE-2024-45497, which involves the openshift-controller-manager build process allowing the overwriting of node pull credentials. This could potentially lead to unauthorized modification of credentials used for pulling container images. Additionally, CVE-2025-22868 addresses unexpected memory consumption during token parsing in the golang.org/x/oauth2/jws package. The advisory covers container images and RPM packages for OpenShift Container Platform 4.14. Users of versions >=4.14.0 and <4.14.53 are affected and should upgrade to 4.14.53 or later. The vendor provides detailed upgrade instructions and image digests for multiple architectures. The update is classified as important, with no known active exploitation reported.

The primary impact of CVE-2024-45497 is that the build process in OpenShift allows overwriting of node pull credentials, which could lead to unauthorized access or modification of credentials used to pull container images. This could affect the integrity and security of container deployments. The memory consumption issue (CVE-2025-22868) may affect performance or stability during token parsing but is less critical. No known exploits in the wild have been reported, reducing immediate risk. The vulnerability affects on-premise or private cloud deployments of OpenShift Container Platform 4.14 prior to 4.14.53.

Red Hat has released OpenShift Container Platform 4.14.53 which includes fixes for these vulnerabilities. Users should upgrade to version 4.14.53 or later using the OpenShift CLI (oc) or web console following the vendor's upgrade documentation. The vendor advisory confirms the availability of this official fix. No additional mitigation steps are indicated beyond applying the update. Users should monitor the vendor's release notes and errata for further guidance.