Red Hat Security Advisory: OpenShift Container Platform 4.17.8 security update

Red Hat OpenShift Container Platform 4.15 and 4.17 releases include a critical security update addressing CVE-2024-5154, a vulnerability in the cri-o container runtime that permits a malicious container to create symbolic links on the host, potentially leading to unauthorized file system manipulation. The 4.17.8 update also fixes CVE-2024-6119, a possible denial of service in OpenSSL's X.509 name checks, and CVE-2024-9341, a FIPS crypto-policy directory mounting issue affecting Podman, Buildah, and cri-o components. These fixes are delivered via updated RPM packages and container images. Red Hat provides official advisories and upgrade instructions for affected OpenShift Container Platform versions. The updates cover multiple architectures including x86_64, s390x, ppc64le, and aarch64.

The primary impact is that a malicious container could exploit the cri-o vulnerability to create symbolic links on the host system, which may allow unauthorized access or manipulation of host files. The OpenSSL vulnerability could lead to denial of service during X.509 name checks. The FIPS crypto-policy mounting issue may affect cryptographic policy enforcement in containers. These vulnerabilities could compromise container isolation and system stability if exploited.

Red Hat has released official security updates for OpenShift Container Platform versions 4.15.17 and 4.17.8 that address these vulnerabilities. Users should upgrade to these updated packages and container images as soon as they are available in their respective release channels. Upgrade instructions are provided by Red Hat in their official documentation. No additional mitigation steps are indicated beyond applying the official updates.