This advisory covers container image updates for Red Hat Advanced Cluster Management for Kubernetes version 2.11.7, which address several security vulnerabilities. Notable fixes include CVE-2024-45336, which involves sensitive headers being incorrectly sent after cross-domain redirects in the net/http package; CVE-2025-22869, a denial of service vulnerability in the key exchange of golang.org/x/crypto/ssh; CVE-2025-30204, excessive memory allocation during JWT header parsing in golang-jwt/jwt; and CVE-2025-22866, a timing side-channel vulnerability for P-256 on ppc64le architectures in crypto/internal/nistec. The advisory references updated container images and recommends applying these updates to affected versions.

The vulnerabilities fixed in this update could allow denial of service conditions, potential memory exhaustion, timing side-channel attacks, and leakage of sensitive headers after cross-domain redirects. These issues could impact the confidentiality, integrity, and availability of the Red Hat Advanced Cluster Management environment if exploited. However, there are no known exploits in the wild at this time.

Red Hat has released updated container images for Red Hat Advanced Cluster Management for Kubernetes 2.11.7 that address these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. The vendor advisory does not indicate any alternative mitigations or that no action is required. Patch status is confirmed as fixed in version 2.11.7.