This advisory covers security updates for Red Hat OpenShift Container Platform, specifically addressing CVE-2024-6538, a Server-Side Request Forgery vulnerability in the OpenShift Console, and CVE-2025-22868, an unexpected memory consumption issue during token parsing in golang.org/x/oauth2/jws. The vulnerabilities affect OpenShift Container Platform versions 4.18.0 through 4.18.13 and 4.15 through 4.15.56. Red Hat has released fixed container images and RPM packages in versions 4.18.14 and 4.15.57 respectively. The advisory includes instructions for upgrading clusters using the OpenShift CLI or web console. The vulnerabilities have been assigned high and important security impact ratings by Red Hat Product Security. No known exploits in the wild have been reported at the time of the advisory.

The Server-Side Request Forgery vulnerability (CVE-2024-6538) in the OpenShift Console could allow an attacker to induce the server to make HTTP requests to unintended locations, potentially leading to unauthorized access or information disclosure. The unexpected memory consumption vulnerability (CVE-2025-22868) in the golang.org/x/oauth2/jws package could lead to resource exhaustion during token parsing, potentially causing denial of service conditions. Both vulnerabilities affect on-premise or private cloud deployments of Red Hat OpenShift Container Platform. No active exploitation has been reported.

Red Hat has released fixed container images and RPM packages in OpenShift Container Platform versions 4.18.14 and 4.15.57 that address these vulnerabilities. Users running affected versions (>=4.18.0 <4.18.14 and versions prior to 4.15.57) should upgrade to these fixed releases as soon as possible. Upgrades can be performed using the OpenShift CLI (oc) or the web console. Detailed upgrade instructions are available in the official Red Hat documentation. No additional mitigations are specified by the vendor beyond applying these updates.