Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.55. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:34097

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.17.55 bug fix and security update

A security vulnerability (CVE-2026-27140) affecting the Go Toolset in Red Hat Enterprise Linux 8.8 allows arbitrary code execution via malicious SWIG file names. This issue was addressed by Red Hat in an important security update for the go-toolset:rhel8 module. The vulnerability involves the cmd/go component of the Go programming language tools and libraries.

Red Hat Security Advisory: go-toolset:rhel8 security update

A security vulnerability (CVE-2026-27140) in the Go Toolset for Red Hat Enterprise Linux 8.6 allows arbitrary code execution via malicious SWIG file names. This issue affects the cmd/go component of the Go programming language tools and libraries. Red Hat has issued an important security update to address this vulnerability.

A security vulnerability (CVE-2026-27140) in the Go Toolset for Red Hat Enterprise Linux 8.4 allows arbitrary code execution via malicious SWIG file names. This issue affects the Go programming language tools and libraries, specifically the cmd/go component. Red Hat has issued an important security update to address this flaw.

A security vulnerability (CVE-2026-27140) affecting the golang packages in Red Hat Enterprise Linux 9.2 allows arbitrary code execution via malicious SWIG file names. This flaw exists in the Go programming language compiler and its cmd/go tool. Red Hat has issued an important security update to address this issue. The vulnerability is rated with high severity by Red Hat Product Security. No public exploit code or in-the-wild exploitation is currently known. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 9.2.

Red Hat Security Advisory: golang security update

A security vulnerability (CVE-2026-27140) affecting the golang packages in Red Hat Enterprise Linux 9.0 allows arbitrary code execution via malicious SWIG file names. This issue impacts the Go programming language compiler and the cmd/go tool. Red Hat has released an important security update addressing this flaw.

A security vulnerability (CVE-2026-27140) affecting the golang packages in Red Hat Enterprise Linux 9.4 allows arbitrary code execution via malicious SWIG file names in the Go compiler and cmd/go tool. Red Hat has issued an important security update to address this issue. The vulnerability is rated with high severity by Red Hat Product Security. The update is available for multiple Red Hat Enterprise Linux 9.4 variants and architectures.

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

* cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140)

* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. 

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

* cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140)

* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A security update for Go version 1.25 addresses multiple vulnerabilities including trust layer bypass, memory corruption, interface conversion bypass, and other issues in components such as cmd/go, cmd/compile, crypto/x509, os, crypto/tls, archive/tar, and html/template. The update advances to version go1.25.9 and fixes several high-severity issues reported by the SUSE Product Security Team.

Security update for go1.25

Multiple security issues have been addressed in the go1.25-1.25.9-1.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by several CVEs, improving the security posture of the affected SUSE product. No specific details about the nature of the vulnerabilities or their impacts are provided.

go1.25-1.25.9-1.1 on GA media

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Search: CVE-2026-27140