Loading story…
Red Hat released container-image and platform updates across its Kubernetes portfolio to remediate vulnerabilities in Go dependencies, chiefly CVE-2024-45337 in golang.org/x/crypto/ssh and CVE-2024-45338 in golang.org/x/net/html. The SSH issue can enable authorization bypass when applications misuse ssh.ServerConfig.PublicKeyCallback; the HTML flaw involves non-linear parsing of case-insensitive content. Affected products include OpenShift Container Platform 4.15 and 4.18, Advanced Cluster Management 2.9.6, Multicluster Global Hub 1.2 and 1.3, Gatekeeper 3.14 and 3.15, OpenShift Data Foundation 4.15, VolSync 0.10 and 0.11, and Advanced Cluster Security (RHACS) 4.4 and 4.5.
Several releases also address CVE-2024-53259, a quic-go denial-of-service flaw in which forged ICMP Packet Too Large messages can disrupt established QUIC connections, and RHACS 4.6.2 fixes go-git argument injection (CVE-2025-21613) and malicious Git-server reply denial of service (CVE-2025-21614). Red Hat recommends upgrading affected platforms and container images through their supported release channels, including deployments on x86_64, aarch64, ppc64le, and s390x where applicable; RHACS customers should move to 4.4.8, 4.5.6, or 4.6.2 according to their release stream.
See affected versions and whether adversaries are exploiting it.
17 events from the most recent confirmed update back to the earliest known activity.
Important advisory RHSA-2025:3542 released updated OpenShift Data Foundation 4.15 images for RHEL 9, fixing CVE-2024-45337 and CVE-2024-45338 and upgrading Ceph to RHCEPH-7.1z3 in ODF 4.15.13.
Important advisory RHSA-2024:6121 updated OpenShift Container Platform 4.18 packages and images to fix CVE-2024-45337 and Helm secret-exposure flaw CVE-2019-25210.
Red Hat issued Important advisory RHSA-2025:1468 for RHACS 4.4.8, remediating an npm XSS flaw, the go-git argument-injection and denial-of-service flaws, and the Go SSH and HTML parsing vulnerabilities.
Important advisory RHSA-2025:1334 provided RHACS 4.5.6 images fixing CVE-2024-11831, CVE-2024-45337, CVE-2024-45338, CVE-2025-21613, and CVE-2025-21614.
Red Hat issued Important advisory RHSA-2025:1331 for Gatekeeper v3.17.1, remediating CVE-2024-45337 and CVE-2024-45338. The update also added controlled audit and webhook containerArguments support and default admission-control namespace exemptions.
Red Hat issued Important advisory RHSA-2025:1332 for Gatekeeper 3.15.3, remediating CVE-2024-45337 and CVE-2024-45338 and adding configurable container arguments and default namespace exemptions.
Important advisory RHSA-2025:1333 released Gatekeeper 3.14.3 with fixes for CVE-2024-45337 and CVE-2024-45338, configurable audit and webhook container arguments, and default admission-control namespace exemptions.
Critical advisory RHSA-2025:0907 delivered RHACS 4.6.2 images fixing CVE-2024-45338 and the go-git flaws CVE-2025-21613 and CVE-2025-21614; it also corrected Scanner V2 and roxctl defects.
Red Hat issued Important advisory RHSA-2025:0645, updating OpenShift Container Platform 4.15 packages and images to remediate CVE-2024-45337 and CVE-2024-45338.
Red Hat issued Important advisory RHSA-2025:0679 for Advanced Cluster Management for Kubernetes 2.10.7 on RHEL 9, providing updated container images that fix CVE-2024-45337 and CVE-2024-45338 along with additional CVEs and product defects.
Important advisory RHSA-2025:0577 delivered Multicluster Global Hub 1.3.2 images, including fixes for CVE-2024-45337 and CVE-2024-45338.
Red Hat issued Important advisory RHSA-2025:0576 for Advanced Cluster Management for Kubernetes 2.9.6, providing updated images that remediate CVE-2024-45337 and CVE-2024-45338.
Important advisory RHSA-2025:0560 released Multicluster Global Hub 1.2.1 container images and fixed the golang.org/x/crypto/ssh authorization-bypass issue CVE-2024-45337 and golang.org/x/net/html parsing flaw CVE-2024-45338.
Red Hat issued Important advisory RHSA-2025:0386 for VolSync 0.10.2 images, remediating CVE-2024-53259, CVE-2024-45337, and CVE-2024-45338 for Advanced Cluster Management deployments on RHEL 9.
Red Hat issued Important advisory RHSA-2025:0385 for VolSync 0.11.1 on RHEL 9, fixing CVE-2024-53259 in quic-go and CVE-2024-45337 and CVE-2024-45338 in Go components.
Red Hat addressed CVE-2024-53259 for Ansible Automation Platform 2.5 through advisory RHSA-2024:10766.
The quic-go project fixed CVE-2024-53259, an off-path ICMP Packet Too Large injection vulnerability that could disrupt established QUIC connections, in version 0.48.2.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
16 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued security updates across OpenShift Container Platform (OCP), OpenShift API for Data Protection (OADP), Migration Toolkit for Containers, OpenShift Logging, and OpenShift Virtualization to remediate denial-of-service, memory-consumption, argument-injection, information-disclosure, and authorization-bypass risks. A recurring issue is `CVE-2024-45338` in `golang.org/x/net/html`, whose non-linear parsing behavior can enable denial of service; it was addressed in OCP 4.17.16, OADP 1.3.7, OpenShift Logging 6.0.6, OpenShift Virtualization 4.16.7, and MTC 1.8.7. OCP 4.16.23 and 4.17.3 also fixed `CVE-2024-24786`, in which malformed JSON can cause an infinite loop in `golang-protobuf` processing. OADP 1.4.5 additionally remediates Go-library flaws that could permit authorization bypass, HTTP request smuggling, memory-exhaustion denial of service, SSH key-exchange denial of service, and go-git argument injection. The go-git issue, `CVE-2025-21613`, affects versions before 5.13.0 when the file transport shells out to Git binaries and can allow attacker-controlled `git-upload-pack` flags. Red Hat directs affected administrators to apply prerequisite errata and upgrade through the appropriate OpenShift release channel or product-specific update procedures across supported RHEL 8 and RHEL 9 architectures.
Aug 28, 2026
Red Hat released security updates across **OpenShift Container Platform**, OpenShift Data Foundation, OpenShift Serverless, distributed tracing, and the Red Hat build of Cryostat. The updates remediate vulnerabilities in shared Go, OpenSSH, networking, image-handling, and third-party libraries that could enable denial of service, resource exhaustion, memory leakage, sensitive-information exposure, or improper privilege propagation. Affected deployments span RHEL 8 and RHEL 9 and supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE architectures. Notable fixes include **CVE-2023-48795** (Terrapin), which permits an active attacker to truncate initial SSH secure-channel messages under vulnerable ChaCha20-Poly1305 or Encrypt-then-MAC configurations, and **CVE-2024-1394**, an RSA error-path memory leak in `golang-fips/openssl` that can cause resource exhaustion. OpenShift Container Platform updates also address a possible OpenSSH remote-code-execution condition on RHEL 9 associated with a signal-handling race. Red Hat advised customers to install relevant prior errata and upgrade clusters and operators through their supported release channels; temporary Terrapin mitigations include disabling `chacha20-poly1305` and EtM MAC algorithms where updates cannot be deployed immediately.
Aug 27, 2026
Red Hat released Important security updates for **Red Hat Advanced Cluster Security for Kubernetes (RHACS)** 4.5, 4.6, and 4.7. Updated images—RHACS 4.5.9, 4.6.5, and 4.7.2—remediate vulnerabilities in bundled `http-proxy-middleware`, `redoc`, `golang-jwt/jwt`, and, for 4.5, `libxml2` and OpenSSL. The fixes include `CVE-2024-21536` and `CVE-2024-57083`, denial-of-service issues respectively involving `http-proxy-middleware` and Redoc prototype pollution, plus `CVE-2025-30204`, which can cause excessive memory allocation while parsing JWT headers. The releases also correct selected product defects affecting compliance displays, delegated scanning, RBAC, GKE compatibility, and image-signature verification. Red Hat also updated Submariner container images used by **Red Hat Advanced Cluster Management for Kubernetes (ACM)** 2.11 and 2.12, delivering Submariner 0.18.5 and 0.19.4. These images address an ICMP Packet Too Large injection issue in `quic-go` and memory-consumption flaws in `golang.org/x/oauth2/jws` and `golang-jwt/jwt`; the ACM 2.11 update additionally fixes sensitive HTTP-header leakage through cross-domain redirects in Go `net/http` and a P-256 timing side channel on `ppc64le`. Organizations should upgrade affected RHACS and ACM deployments to the supplied patched container images across their supported architectures.
Aug 27, 2026