This Red Hat security advisory (RHSA-2025:8059) addresses multiple vulnerabilities and bugs in Red Hat OpenShift Data Foundation 4.17.7 on Red Hat Enterprise Linux 9. The product is a software-defined storage solution integrated with OpenShift, providing persistent storage and multi-cloud data management with an S3 compatible API. The advisory includes fixes for eight CVEs, including CVE-2024-11831, and resolves issues such as duplicate metrics from rook-ceph-osd-prepare pods, false alert firing, and problems with hub recovery states. The update is delivered as updated container images for various architectures. The vendor recommends applying all prior errata before updating. No CVSS scores are provided, and no active exploitation has been reported. The advisory confirms the availability of fixed versions.

The vulnerabilities addressed are rated high severity and affect the stability, monitoring accuracy, and recovery processes of Red Hat OpenShift Data Foundation deployments. Potential impacts include incorrect metrics reporting, unnecessary alerting, and issues in disaster recovery state reconciliation, which could affect application availability and data integrity in stateful applications relying on this storage platform. No known active exploits have been reported, reducing immediate risk of exploitation.

Red Hat has released updated container images for OpenShift Data Foundation 4.17.7 that fix the identified vulnerabilities and bugs. Users should ensure all previously released errata are applied before updating to these fixed versions. Applying the update will remediate the issues described. No additional mitigation steps are indicated by the vendor advisory.