RHSA-2026:57402: Important: OpenShift Container Platform 4.19.44 bug fix and security update
Important: OpenShift Container Platform 4.19.44 bug fix and security update
Other sources
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.44. See the following advisory for the RPM packages for this release:https://access.redhat.com/errata/RHSA-2026:57401 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:https://docs.redhat.com/en/documentation/openshiftcontainerplatform/4.19/html/releasenotes/ Security Fix(es): kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518) gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment (CVE-2026-33845) gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) kernel: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath (CVE-2026-43112) gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) vim: command injection when decompressing .tgz archives (CVE-2026-46483) libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshiftcontainerplatform/4.19/html-single/updatingclusters/index#updating-cluster-cli.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenShift Container Platform 4.19to a version that resolves this vulnerability.Fixed in 4.19.44Patch RHSA-2026:57401 - Compensating control
Before/while upgrading OpenShift Container Platform 4.19, inspect release image metadata for architectures x86_64, s390x, ppc64le, and aarch64 using the oc tool, and ensure you fully apply the asynchronous errata update as described in the OpenShift 4.19 upgrade documentation.
- Operational
After upgrading OpenShift Container Platform to 4.19.44, verify your cluster receives and runs the updated release images in the appropriate release channel (check with oc or the web console).
Event History
Frequently Asked Questions
Which OpenShift platform architectures are covered by this container image update?
The advisory covers Red Hat OpenShift Container Platform for standard deployments, Power, ARM 64, and IBM Z and LinuxONE.
Are the RPM packages for this release included in this advisory?
No. The RPM packages are provided through the separate RHSA-2026:57401 advisory.
What types of security issues are addressed?
The listed weaknesses include buffer overflow, path traversal, and command injection. The named fixes include kernel privilege escalation and out-of-bounds read issues, GnuTLS DTLS denial-of-service flaws, and Vim arbitrary command execution.