End of life: 12/31/2027, End of support: 12/31/2026, Latest version: 4.22.9

Summary: Possible DOS in SPDY streaming code, used for attach, exec and port forwarding.

Requirements To Exploit: Access to the kubelet's endpoint (granted through nodes/proxy) or access to any of portforward, exec, or attach to pods. These all can be represented by the cluster roles

pods/portforward (create)

pods/exec (create)

pods/attach (create)

nodes/proxy (get/create)

Component Affected: Kubelet, CRI-O, kube-apiserver

Version Affected: Openshift 4.21.4 and below

Patch Available: yes

Version Fixed: none yet

Cvss: (Based on [https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator]). Please note that only the Base Score Metrics are required by the incident response team.

Impact: Based on the https://access.redhat.com/security/updates/classification , what do you think would be the impact and why? This helps a lot the analyst to understand why such a report must be or not considered Moderate/Important or even Critical.

Steps To Reproduce: apply:

— apiVersion: v1 kind: ServiceAccount metadata: name: poc-sa-portforward namespace: default — apiVersion: [rbac.authorization.k8s.io/v1:(http://rbac.authorization.k8s.io/v1)(http://rbac.authorization.k8s.io/v1)] kind: Role metadata: name: poc-role-portforward namespace: default rules:

apiGroups: [""] resources: ["pods/portforward"] verbs: ["create"] — apiVersion: [rbac.authorization.k8s.io/v1:(http://rbac.authorization.k8s.io/v1)(http://rbac.authorization.k8s.io/v1)] kind: RoleBinding metadata: name: poc-rb-portforward namespace: default subjects:

kind: ServiceAccount name: poc-sa-portforward namespace: default roleRef: kind: Role name: poc-role-portforward apiGroup: rbac.authorization.k8s.io — apiVersion: v1 kind: Pod metadata: name: poc-target namespace: default spec: containers:

name: nginx image: nginx:alpine

set env:

export APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}' | sed 's|https://||')

export TOKEN=$(kubectl create token poc-sa-portforward)

export POD=poc-target

run attached pocportforward.py

Mitigation: disable the above cluster roles from untrusted users.

Embargo Reason: Coordination with three upstream communities: containerd, CRI-O, kubernetes

Original Report: https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. These Routes are managed by the openshift-ingress/router-default pods. One of the features of Routes is their ability to match a URI's path and replace it, this is expressed in the Route by the spec.path and metadata.annotations"[haproxy.router.openshift.io/rewrite-target YAML stanzas in a Route document which are in turn (after various checks and sanitization) used as parameters to a HAProxy configuration template. This configuration template is expressed in plaintext, thus the templating engine cannot automatically escape values to enforce the document structure, escaping has to be performed on the values before the template's evaluation.

By default the Developer role can create Routes to expose their services.

It was found that the checks performed on the Routes spec.path was insufficient and could allow a controlled injection of the HAProxy configuration.

End of life: 4/21/2027, End of support: 5/3/2026, Latest version: 4.20.35

End of life: 8/3/2027, End of support: 9/9/2026, Latest version: 4.21.30

This release of the Red Hat OpenShift distributed tracing platform (Jaeger) provides security improvements.Breaking changes: Nothing Deprecations: Nothing Technology Preview features: Nothing Enhancements: Nothing Bug fixes: https://access.redhat.com/security/cve/CVE-2025-4373 https://access.redhat.com/security/cve/CVE-2024-34397 https://access.redhat.com/security/cve/CVE-2024-52533 Known issues: Nothing

End of life: 12/17/2026, End of support: 1/21/2026, Latest version: 4.19.43

Moderate: Release of OpenShift Serverless Logic 1.36.0 security update & enhancements

Important: Red Hat OpenShift GitOps 1.16.1 security release

Errata Advisory for Red Hat OpenShift GitOps v1.14.4 security release.Security Fix(es): openshift-gitops-argocd-container: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.14 openshift-gitops-1/gitops-operator-bundle: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.14 openshift-gitops-1/argocd-rhel9: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.14 openshift-gitops-operator-container: Namespace Isolation Break gitops-1.14 openshift-gitops-dex-container: Unexpected memory consumption during token parsing in golang.org/x/oauth2 gitops-1.14 openshift-gitops-container: Potential denial of service in golang.org/x/crypto gitops-1.14 openshift-gitops-argo-rollouts-container: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS gitops-1.14 openshift-gitops-argocd-container: jwt-go allows excessive memory allocation during header parsing gitops-1.14 openshift-gitops-argocd-rhel9-container: jwt-go allows excessive memory allocation during header parsing gitops-1.14 openshift-gitops-argocd-container: Prototype Pollution in redoc gitops-1.14 openshift-gitops-argocd-rhel9-container: Prototype Pollution in redoc gitops-1.14

Errata Advisory for Red Hat OpenShift GitOps 1.15.3 security release.Security Fix(es): openshift-gitops-argocd-container: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.15 openshift-gitops-1/argocd-rhel9: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.15 openshift-gitops-1/gitops-operator-bundle: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.15

Errata Advisory for Red Hat OpenShift GitOps v1.16.1 security release.Security Fix(es): openshift-gitops-argocd-container: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.16 openshift-gitops-1/gitops-operator-bundle: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.16

Errata Advisory for Red Hat OpenShift GitOps 1.15.2 release<br>Security Fix(es):<br><li> openshift-gitops-operator-container: Namespace Isolation Break gitops-1.15 </li> <li> openshift-gitops-argocd-container: Go JOSE's Parsing Vulnerable to Denial of Service gitops-1.15 </li> <li> openshift-gitops-argocd-rhel9-container: Go JOSE's Parsing Vulnerable to Denial of Service gitops-1.15 </li> <li> openshift-gitops-dex-container: Go JOSE's Parsing Vulnerable to Denial of Service gitops-1.15 </li> <li> openshift-gitops-operator-bundle-container: Go JOSE's Parsing Vulnerable to Denial of Service gitops-1.15 </li> <li> openshift-gitops-container: Potential denial of service in golang.org/x/crypto gitops-1.15 </li> <li> openshift-gitops-argo-rollouts-container: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS gitops-1.15 </li> <li> openshift-gitops-argocd-container: Memory Exhaustion in Expr Parser with Unrestricted Input gitops-1.15 </li> <li> openshift-gitops-argocd-rhel9-container: Memory Exhaustion in Expr Parser with Unrestricted Input gitops-1.15 </li> <li> openshift-gitops-argocd-container: jwt-go allows excessive memory allocation during header parsing gitops-1.15 </li> <li> openshift-gitops-argocd-rhel9-container: jwt-go allows excessive memory allocation during header parsing gitops-1.15 </li> <li> openshift-gitops-operator-bundle-container: jwt-go allows excessive memory allocation during header parsing gitops-1.15 </li> <li> openshift-gitops-argocd-container: Prototype Pollution in redoc gitops-1.15 </li> <li> openshift-gitops-argocd-rhel9-container: Prototype Pollution in redoc gitops-1.15 </li> <li> openshift-gitops-dex-container: Unexpected memory consumption during token parsing in golang.org/x/oauth2 gitops-1.15</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE page(s)<br>listed in the References section.

Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.10

End of life: 8/25/2026, End of support: 9/17/2025, Latest version: 4.18.53

Important: Red Hat OpenShift Service Mesh Containers for 2.4.14

Important: Red Hat OpenShift Service Mesh Containers for 2.5.8

Important: Red Hat OpenShift Service Mesh Containers for 2.6.5

Moderate: Release of OpenShift Serverless Logic 1.35.0 security update & enhancements

End of life: 12/27/2025, End of support: 1/1/2025, Latest version: 4.16.68

End of life: 12/27/2025, End of support: 1/1/2025, Latest version: 4.16.68

End of life: 4/1/2026, End of support: 5/25/2025, Latest version: 4.17.55

End of life: 4/1/2026, End of support: 5/25/2025, Latest version: 4.17.55

End of life: 8/27/2025, End of support: 9/27/2024, Latest version: 4.15.67

End of life: 8/27/2025, End of support: 9/27/2024, Latest version: 4.15.67

Low: Red Hat OpenShift Service Mesh Containers for 2.4.13

Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.7

End of life: 7/17/2024, End of support: 8/17/2023, Latest version: 4.12.96

End of life: 7/17/2024, End of support: 8/17/2023, Latest version: 4.12.96

Important: Red Hat OpenShift Service Mesh Containers for 2.5.6