Red Hat Security Advisory: OpenShift Container Platform 4.17.58 packages and security update

This advisory covers multiple security fixes in Red Hat OpenShift Container Platform 4.17.58 and later releases, addressing vulnerabilities such as CVE-2026-15809, a bypass in cri-o allowing /etc/passwd injection via the HOME environment variable. Other fixed issues include denial of service vulnerabilities in Go encoding/asn1, JSON Web Encryption processing, XML decoding, URL path resolution, and TLS KeyUpdate handling. Additionally, a privilege escalation vulnerability due to incorrect Punycode label processing and a cross-site scripting vulnerability in Go's html/template package are addressed. The vendor advisory confirms these fixes are included in updated RPM packages and container images, with instructions for upgrading clusters provided by Red Hat.

The vulnerabilities fixed in these OpenShift Container Platform releases include potential bypass of security controls allowing injection into /etc/passwd, denial of service conditions caused by crafted inputs leading to excessive recursion or resource exhaustion, privilege escalation through improper Punycode handling, and cross-site scripting via malformed input. These issues could impact the confidentiality, integrity, and availability of affected OpenShift deployments if exploited. However, there are no known exploits in the wild at this time.

Red Hat has released updated RPM packages and container images for OpenShift Container Platform versions including 4.22.11 and earlier affected versions. Users should upgrade their OpenShift clusters to these updated versions using the OpenShift CLI (oc) or web console as soon as the updates are available in their release channels. Detailed upgrade instructions are available in the Red Hat documentation. Patch status is confirmed by the vendor advisory, and applying these updates fully mitigates the described vulnerabilities.