Red Hat Security Advisory: OpenShift Container Platform 4.16.34 security and extras update
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.16.34. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2025:1124 Security Fix(es): * golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338) * jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
AI Analysis
Technical Summary
This advisory covers security fixes in Red Hat OpenShift Container Platform 4.16.34, which addresses several vulnerabilities: CVE-2024-12085 involves an information leak via uninitialized stack contents in rsync; CVE-2024-45338 concerns non-linear parsing of case-insensitive content in golang.org/x/net/html; CVE-2024-56201 and CVE-2024-56326 are sandbox breakout vulnerabilities in Jinja2 through malicious filenames and indirect references to the format method, respectively. The update includes RPM packages and container images to remediate these issues. The vendor rates the security impact as important and recommends upgrading all OpenShift Container Platform 4.16 users to 4.16.34. The advisory also references an updated Compliance Operator image (v1.8.0) with bug fixes and enhancements unrelated to these CVEs. The update process is documented by Red Hat, and users should follow official upgrade instructions to apply the fixes.
Potential Impact
The vulnerabilities fixed in OpenShift Container Platform 4.16.34 could lead to information leakage (CVE-2024-12085), improper parsing that may affect application behavior (CVE-2024-45338), and sandbox breakout in Jinja2 templates (CVE-2024-56201 and CVE-2024-56326), potentially allowing malicious code execution or privilege escalation within the templating environment. These issues impact the security posture of OpenShift clusters deployed on-premise or in private clouds. The vendor classifies the overall security impact as important, indicating a high severity but not critical. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released OpenShift Container Platform 4.16.34 containing fixes for the identified vulnerabilities. Users should upgrade to version 4.16.34 using the OpenShift CLI or web console following the official upgrade documentation. The vendor advises applying these updated packages and container images as soon as they become available in the appropriate release channels. For the Compliance Operator, users should upgrade to version 1.8.0 to benefit from bug fixes and enhancements. No additional mitigations are specified beyond applying these official updates.
Red Hat Security Advisory: OpenShift Container Platform 4.16.34 security and extras update
Description
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.16.34. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2025:1124 Security Fix(es): * golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338) * jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers security fixes in Red Hat OpenShift Container Platform 4.16.34, which addresses several vulnerabilities: CVE-2024-12085 involves an information leak via uninitialized stack contents in rsync; CVE-2024-45338 concerns non-linear parsing of case-insensitive content in golang.org/x/net/html; CVE-2024-56201 and CVE-2024-56326 are sandbox breakout vulnerabilities in Jinja2 through malicious filenames and indirect references to the format method, respectively. The update includes RPM packages and container images to remediate these issues. The vendor rates the security impact as important and recommends upgrading all OpenShift Container Platform 4.16 users to 4.16.34. The advisory also references an updated Compliance Operator image (v1.8.0) with bug fixes and enhancements unrelated to these CVEs. The update process is documented by Red Hat, and users should follow official upgrade instructions to apply the fixes.
Potential Impact
The vulnerabilities fixed in OpenShift Container Platform 4.16.34 could lead to information leakage (CVE-2024-12085), improper parsing that may affect application behavior (CVE-2024-45338), and sandbox breakout in Jinja2 templates (CVE-2024-56201 and CVE-2024-56326), potentially allowing malicious code execution or privilege escalation within the templating environment. These issues impact the security posture of OpenShift clusters deployed on-premise or in private clouds. The vendor classifies the overall security impact as important, indicating a high severity but not critical. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released OpenShift Container Platform 4.16.34 containing fixes for the identified vulnerabilities. Users should upgrade to version 4.16.34 using the OpenShift CLI or web console following the official upgrade documentation. The vendor advises applying these updated packages and container images as soon as they become available in the appropriate release channels. For the Compliance Operator, users should upgrade to version 1.8.0 to benefit from bug fixes and enhancements. No additional mitigations are specified beyond applying these official updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:1123
- Cve Count
- 4
- Additional Cves
- ["CVE-2024-45338","CVE-2024-56201","CVE-2024-56326"]
- Cvss Version
- 3.1
Threat ID: 6a18be67e29bf47b50388260
Added to database: 05/28/2026, 22:15:03 UTC
Last enriched: 08/10/2026, 20:52:08 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 144
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.