Red Hat OpenShift Updates Fix Telemetry JWT Bypass and Terrapin SSH Flaw

Red Hat released security updates for OpenShift Container Platform (OCP) 4.14.32 and 4.15.20 that remediate CVE-2024-5037, an issuer-validation bypass affecting OpenShift Telemetry JWT authentication, and CVE-2023-48795 (Terrapin), an SSH Binary Packet Protocol prefix-truncation vulnerability. The Important-severity updates provide refreshed container images for supported OCP deployments on RHEL 8 and RHEL 9 across x86_64, s390x, ppc64le, and aarch64 architectures; Red Hat advises customers to upgrade through their applicable release channel using the OpenShift CLI or web console.

Red Hat also shipped OCP 4.15.0 packages and images addressing security issues in bundled Go and OpenTelemetry components, including XSS, denial-of-service, go-git path traversal and potential remote-code-execution risks, as well as Terrapin. Until SSH updates can be deployed, organizations can verify Terrapin protection by confirming clients advertise kex-strict-c-v00@openssh.com and servers return kex-strict-s-v00@openssh.com; temporary RHEL crypto-policy restrictions can disable affected ChaCha20-Poly1305 and encrypt-then-MAC algorithms, though they may reduce interoperability.