This Red Hat security advisory covers OpenShift Container Platform 4.14.48, which contains updated container images and packages that fix multiple security vulnerabilities. Notably, it addresses CVE-2024-12085, an information leak via uninitialized stack contents in rsync, and CVE-2024-45337, an authorization bypass due to misuse of ServerConfig.PublicKeyCallback in golang.org/x/crypto/ssh. Additional fixes include a non-linear parsing issue in golang.org/x/net/html and a kernel media driver fix (uvcvideo). The advisory provides updated images for multiple architectures and instructs users to upgrade using the OpenShift CLI or web console. The update is rated as having an important security impact by Red Hat Product Security.

The vulnerabilities fixed in this update could lead to information disclosure (rsync info leak) and potential authorization bypass (golang.org/x/crypto/ssh). These issues may allow attackers to gain unauthorized access or leak sensitive information if exploited. The update mitigates these risks by correcting the underlying flaws in the affected components. No known exploits in the wild have been reported at the time of this advisory.

A fix is available in Red Hat OpenShift Container Platform version 4.14.48. Users should upgrade to this version using the OpenShift CLI (oc) or web console as soon as the update is available in their release channel. Detailed upgrade instructions are provided in the official Red Hat documentation. No additional mitigation steps are indicated beyond applying this update.