This advisory for Red Hat OpenShift Container Platform 4.15.62 addresses two vulnerabilities: CVE-2025-58183 involves an unbounded allocation vulnerability in the golang archive/tar package when parsing GNU sparse maps, potentially leading to resource exhaustion. CVE-2025-65637 is a denial-of-service vulnerability in the github.com/sirupsen/logrus logging library caused by processing large single-line payloads. Both issues have been assigned a moderate severity by Red Hat Product Security. The advisory includes updated RPM packages and container images to fix these vulnerabilities. Users should upgrade their OpenShift Container Platform 4.15 clusters using the provided packages and follow Red Hat's upgrade documentation to fully apply the fixes. No CVSS scores are provided in the advisory, and no known active exploits have been reported.

The vulnerabilities could lead to denial-of-service conditions due to unbounded memory allocation or resource exhaustion when processing specially crafted inputs in affected components (golang archive/tar and logrus). This may affect the stability and availability of OpenShift Container Platform 4.15 deployments. No evidence of active exploitation in the wild has been reported. The overall security impact is rated as moderate by Red Hat Product Security.

Red Hat has released updated RPM packages and container images in OpenShift Container Platform 4.15.62 that address these vulnerabilities. Users are advised to upgrade to these updated packages and images via the appropriate release channels using the OpenShift CLI or web console. Detailed upgrade instructions are available in Red Hat's official documentation. Applying these updates fully mitigates the vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.