This advisory covers security fixes in Red Hat OpenShift Container Platform 4.18.14, specifically addressing CVE-2024-6538, a Server-Side Request Forgery vulnerability in the OpenShift Console, and CVE-2025-22868, an unexpected memory consumption issue during token parsing in the golang.org/x/oauth2/jws package. The update includes container image and package fixes for multiple architectures and is intended for on-premise or private cloud deployments of OpenShift Container Platform 4.18. The vendor rates the security impact as important and recommends upgrading to the updated release to apply these fixes.

The SSRF vulnerability (CVE-2024-6538) in the OpenShift Console could allow an attacker to induce the server to make unintended requests, potentially leading to unauthorized actions or information disclosure within the affected environment. The memory consumption issue (CVE-2025-22868) during token parsing could lead to resource exhaustion, impacting service availability. Both vulnerabilities affect Red Hat OpenShift Container Platform 4.18 deployments. No known exploits in the wild have been reported at this time.

Red Hat has released OpenShift Container Platform 4.18.14 containing updated container images and packages that address these vulnerabilities. Users of OpenShift Container Platform 4.18 are strongly advised to upgrade to this release as soon as it is available in their appropriate release channel. Upgrades can be performed using the OpenShift CLI (oc) or the web console. Detailed upgrade instructions are provided by Red Hat at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. No alternative mitigations or workarounds are indicated in the vendor advisory.