This security advisory addresses vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.14 images, specifically versions >=2.14.0 and <2.14.2. The vulnerabilities include concurrency issues such as race conditions (CWE-362), improper access control, and other weaknesses (CWE-276, CWE-94, CWE-770, CWE-1050, CWE-79, CWE-330, CWE-20). One notable CVE (CVE-2025-47907) involves a race condition in database/sql that can cause inconsistent query results when queries are cancelled concurrently. The advisory includes fixes for multiple bugs causing pod crashes, admission webhook denials due to unauthorized changes, and issues with observability components. The update to version 2.14.2 contains these fixes and updated container images.

The vulnerabilities can lead to inconsistent data being returned by the application due to race conditions, denial of service through resource exhaustion or crashes, and unauthorized changes being denied by admission webhooks. These issues may affect cluster provisioning, observability, and policy enforcement in Kubernetes environments managed by Red Hat Advanced Cluster Management. The overall severity is high, reflecting the potential for disruption and data inconsistency in critical cluster management operations.

A fixed version, 2.14.2, is available and should be applied to address these vulnerabilities. The vendor advisory recommends ensuring all previously released errata relevant to the system are applied before updating. Detailed update instructions are available from Red Hat. No alternative mitigations or workarounds are specified, so applying the official update is the primary remediation.