Loading story…
Red Hat released security updates across OpenShift Container Platform, OpenShift Data Foundation, OpenShift Serverless, distributed tracing, and the Red Hat build of Cryostat. The updates remediate vulnerabilities in shared Go, OpenSSH, networking, image-handling, and third-party libraries that could enable denial of service, resource exhaustion, memory leakage, sensitive-information exposure, or improper privilege propagation. Affected deployments span RHEL 8 and RHEL 9 and supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE architectures.
Notable fixes include CVE-2023-48795 (Terrapin), which permits an active attacker to truncate initial SSH secure-channel messages under vulnerable ChaCha20-Poly1305 or Encrypt-then-MAC configurations, and CVE-2024-1394, an RSA error-path memory leak in golang-fips/openssl that can cause resource exhaustion. OpenShift Container Platform updates also address a possible OpenSSH remote-code-execution condition on RHEL 9 associated with a signal-handling race. Red Hat advised customers to install relevant prior errata and upgrade clusters and operators through their supported release channels; temporary Terrapin mitigations include disabling chacha20-poly1305 and EtM MAC algorithms where updates cannot be deployed immediately.
See real exploitation activity before you spend the cycle.
16 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2025:3560 for updated OpenShift Data Foundation 4.14 container images on RHEL 9 for x86_64, ppc64le, s390x, and aarch64. The advisory fixed golang.org/x/crypto/ssh authorization bypass CVE-2024-45337 and golang.org/x/net/html parsing flaw CVE-2024-45338, listed additional CVEs, and upgraded Ceph to RHCEPH-7.1z3 at ODF-4.14.17.
Red Hat issued Important-rated RHSA-2025:1866 for OpenShift Data Foundation 4.14 on RHEL 9 across x86_64, ppc64le, s390x, and aarch64. The updated images address go-retryablehttp sensitive URL logging, PostCSS input validation, a golang.org/x/crypto SSH authorization-bypass condition, and golang.org/x/net/html parsing issues.
Red Hat issued Important-rated RHSA-2025:0224 for the Red Hat build of Cryostat 3 on RHEL 8. The update supplied updated technical-preview container images and remediated CVE-2024-45338, a golang.org/x/net/html non-linear parsing flaw involving case-insensitive content.
Red Hat issued Moderate-rated RHSA-2024:4955, delivering OpenShift Container Platform 4.15.25 container images for supported RHEL 8 and RHEL 9 architectures. The update remediated the Terrapin SSH prefix-truncation vulnerability (CVE-2023-48795) and the RHEL 9 OpenSSH signal-handling race condition (CVE-2024-6409), along with additional bug fixes.
Red Hat issued Important-rated RHSA-2024:4960 with OpenShift Container Platform 4.14.34 images and updates. It remediated vulnerabilities including HTTP/2 denial of service, RSA memory leaks, SSH prefix truncation, image digest validation, sensitive URL logging, and a possible OpenSSH RCE condition on RHEL 9.
Red Hat issued Moderate-rated RHSA-2024:4872 for OpenShift Serverless 1.33.1, supported on OpenShift Container Platform 4.12 through 4.16. The release fixed Go DNS, ZIP-processing, IPv4-mapped IPv6, and sensitive-information logging vulnerabilities.
Red Hat issued Moderate-rated RHSA-2024:4613 with OpenShift Container Platform 4.16.4 container images for RHEL 9. The release fixed the Terrapin SSH prefix-truncation issue, possible OpenSSH signal-handling RCE, and Go, containers/image, and go-retryablehttp vulnerabilities.
Red Hat issued Important-rated RHSA-2024:4479 for OpenShift Container Platform 4.14.33. The update provided packages and container images for RHEL 8 and RHEL 9 architectures, fixing regreSSHion, the Terrapin SSH prefix-truncation flaw, and go-retryablehttp sensitive URL logging.
Red Hat published Important-rated RHSA-2024:4591, updating OpenShift Data Foundation 4.16.0 on RHEL 9. It addressed vulnerabilities including a Submariner Operator RBAC issue that could spread node compromises, Go flaws, Node.js denial-of-service flaws, and secret exposure in NooBaa logs.
Red Hat issued Critical-rated RHSA-2024:0040 for OpenShift Container Platform 4.16.0, providing updated RPM packages for RHEL 9 architectures. The update remediated the Terrapin SSH prefix-truncation flaw, a Go protobuf JSON unmarshalling infinite-loop denial of service, and a CloudEvents Go SDK credential-leak issue.
Red Hat issued Important-rated RHSA-2024:3621 for OpenShift distributed tracing 3.2.0 operator and operand containers. The update fixed vulnerabilities in Go, go-resty, and golang-protobuf, alongside Jaeger, Tempo, and OpenTelemetry fixes and enhancements.
Red Hat issued Important-rated RHSA-2024:2088 for the Red Hat build of Cryostat 2 on RHEL 8, fixing six vulnerabilities including Vert.x memory leaks, Go denial-of-service and certificate-verification flaws, and a Netty resource-exhaustion issue.
Avinash Hanwate reported CVE-2024-1394, a high-severity memory leak in golang-fips/openssl RSA encryption and decryption error paths that could permit resource exhaustion with attacker-controlled inputs.
Avinash Hanwate described CVE-2023-45286 (GO-2023-2328), a go-resty race condition in which retry handling can return an unreset pooled buffer and cause HTTP request bodies from unrelated requests to be sent to another server.
Red Hat documented CVE-2024-6409, a signal-handler race condition in the sshd unprivileged child's cleanup_exit() path in OpenSSH shipped with RHEL 9, introducing the same vulnerability as CVE-2024-6387. Red Hat issued fixes for RHEL 9, RHEL 9.2 EUS, RHEL 9 SAP Update Services, and supported OpenShift Container Platform 4.13 through 4.16 releases.
Red Hat tracked CVE-2023-48795 across affected Fedora, EPEL, OpenStack RDO, RHEL, OpenShift, and related products. The issue allows an active attacker manipulating SSH handshake sequence numbers to remove initial secure-channel messages when ChaCha20-Poly1305 or Encrypt-then-MAC modes are used.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
17 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates for OpenShift Container Platform (OCP) 4.14.32 and 4.15.20 that remediate **CVE-2024-5037**, an issuer-validation bypass affecting OpenShift Telemetry JWT authentication, and **CVE-2023-48795** (Terrapin), an SSH Binary Packet Protocol prefix-truncation vulnerability. The Important-severity updates provide refreshed container images for supported OCP deployments on RHEL 8 and RHEL 9 across x86_64, s390x, ppc64le, and aarch64 architectures; Red Hat advises customers to upgrade through their applicable release channel using the OpenShift CLI or web console. Red Hat also shipped OCP 4.15.0 packages and images addressing security issues in bundled Go and OpenTelemetry components, including XSS, denial-of-service, go-git path traversal and potential remote-code-execution risks, as well as Terrapin. Until SSH updates can be deployed, organizations can verify Terrapin protection by confirming clients advertise `kex-strict-c-v00@openssh.com` and servers return `kex-strict-s-v00@openssh.com`; temporary RHEL crypto-policy restrictions can disable affected ChaCha20-Poly1305 and encrypt-then-MAC algorithms, though they may reduce interoperability.
Aug 27, 2026
Red Hat released security updates across **OpenShift Container Platform (OCP) 4.12 through 4.16** and OpenShift Serverless, remediating vulnerabilities in bundled Go, Linux kernel, glibc, OpenTelemetry, BIND, Ironic, Gunicorn, Werkzeug, and related components. The issues include HTTP/2 and multipart-form memory-exhaustion denial of service—such as `CVE-2023-45288` and `CVE-2023-45290`—sensitive URL data written to logs (`CVE-2024-6104`), cluster-monitoring credential leakage, unauthenticated local access and data exposure in OpenStack Ironic, and an SSH prefix-truncation attack. OpenShift 4.16.0 addressed 16 vulnerabilities, while the 4.14.39 update also fixed a glibc `iconv` out-of-bounds write that may allow remote code execution. Affected organizations should update OCP container images and packages through their supported release channels using the OpenShift CLI or web console, prioritizing deployed 4.12, 4.14, 4.15, and 4.16 clusters. The advisories cover RHEL 8 and RHEL 9 deployments across `x86_64`, `s390x`, `ppc64le`, and `aarch64` where applicable; OpenShift Serverless 1.33.0 also updates Serverless Operator components for OCP 4.12–4.16. Red Hat separately updated the RHEL 9 Go toolchain to version `golang-1.21.9-2.el9_4`, addressing HTTP processing, certificate-verification, redirect-forwarding, template escaping, and cryptographic flaws that affect Go-based workloads and platform components.
Aug 27, 2026
Red Hat released Important-severity updates for **Red Hat Service Interconnect** 1.4 and 1.5, RHEL 9.2 Go packages, and Red Hat OpenStack Platform 17.1 director Operator images to remediate multiple Go vulnerabilities. Key issues include `CVE-2023-45288`, where unlimited HTTP/2 CONTINUATION frames can exhaust resources; `CVE-2024-24783`, which can panic `crypto/x509` certificate verification when an unknown public-key algorithm is processed; and `CVE-2023-39326`, in which oversized HTTP chunk extensions can drive server memory consumption to roughly 1 GiB. The OpenStack update also fixes `CVE-2023-48795`, an SSH Binary Packet Protocol prefix-truncation flaw. Red Hat additionally updated OpenShift Container Platform 4.13 and 4.14 releases for `CVE-2024-1394`, a memory leak in `golang-fips/openssl` RSA encryption and decryption operations; OpenShift 4.14.19 also addresses `CVE-2024-28180`, involving improper handling of highly compressed data in `jose-go`. Affected organizations should update Service Interconnect images and `skupper-cli`, deploy the updated RHEL Go packages and OpenStack operator images, and upgrade OpenShift clusters through their supported release channels across x86_64, ARM64, IBM Power, and IBM Z/LinuxONE where applicable.
Aug 27, 2026