Loading story…
Red Hat released security updates for OpenShift Container Platform 3.11 and 4.5 to address CVE-2016-2183 (SWEET32), a TLS/SSL weakness affecting DES and 3DES 64-bit block ciphers. A network-positioned attacker able to capture sufficiently large volumes of traffic from long-lived connections using these cipher suites may recover portions of encrypted plaintext through a birthday attack; Red Hat rates the issue Moderate.
RHSA-2020:0451 made OpenShift 3.11.170 available for x86_64 and ppc64le, while RHSA-2020:3842 updated the openshift-enterprise-console-container for OpenShift 4.5 on x86_64, ppc64le, and s390x. Administrators should apply prerequisite errata and upgrade affected clusters through the documented OpenShift update process; deployments should prefer AES cipher suites and avoid DES/3DES where compatibility requirements permit.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2020:3842 for openshift-enterprise-console-container in OpenShift Container Platform 4.5.13. The Moderate-severity update fixed CVE-2016-2183 for supported x86_64, ppc64le, and s390x deployments.
Red Hat issued RHSA-2020:0451 and made OpenShift Container Platform 3.11.170 available for x86_64 and ppc64le. The release updated packages and images to fix CVE-2016-2183, along with other security issues and bugs.
Red Hat released RHSA-2017:2709 and RHSA-2017:2710, fixing SWEET32 in JBoss Core Services httpd and OpenSSL packages for RHEL 7 and RHEL 6, respectively.
RHSA-2017:0462 fixed CVE-2016-2183 in the RHEL 6 Supplementary java-1.8.0-ibm package.
Red Hat released RHSA-2017:0336, RHSA-2017:0337, and RHSA-2017:0338 to address SWEET32 in IBM Java packages for RHEL 5 and RHEL 6 supplementary channels.
Red Hat issued RHSA-2016:1940 for RHEL 6 and 7, updating OpenSSL to address ten vulnerabilities including CVE-2016-2183. The update mitigated SWEET32 by lowering DES cipher-suite priority below AES while retaining DES support for compatibility.
A Red Hat Customer Portal notice identified Middleware Suite as affected by CVE-2016-2183 (SWEET32). It stated that exploitation requires a man-in-the-middle to capture at least 32 GB of traffic using negotiated DES or 3DES TLS cipher suites, and recommended disabling those ciphers.
OpenVPN reported CVE-2016-2183 (SWEET32) to Red Hat. Upstream credited Inria researchers Gaëtan Leurent and Karthikeyan Bhargavan as the original reporters.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
11 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcedocs.openshift.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat shipped a series of OpenShift Container Platform security updates across supported release streams, including **4.12.86**, **4.13.64**, **4.17.50**, and **4.19.25**, to remediate multiple flaws in bundled components. The fixes cover `CVE-2025-9230` in OpenSSL, an out-of-bounds read and write in CMS password-based encryption handling that can crash applications or corrupt memory; `CVE-2025-6176` in Scrapy, where brotli decompression can trigger denial of service through excessive memory consumption; `CVE-2025-52881` in `runc` and `opencontainers-selinux`, which can enable container escape and denial of service; and `CVE-2025-61726` in Go's `net/url` package, which can cause memory exhaustion during query parsing. Red Hat rated the OpenShift 4.17 and 4.19 releases as **Important** because of the container escape and resource-exhaustion risks, while updates for 4.12 and 4.13 were published with **Low** security impact despite bundling fixes for OpenSSL, Scrapy/brotli, libssh, glib, and libpng issues. The advisories affect deployments on **RHEL 8** and **RHEL 9** across `x86_64`, `ppc64le`, `s390x`, and `aarch64`, and Red Hat urged customers to upgrade through the appropriate OpenShift release channels using the CLI or web console.
Aug 20, 2026
Red Hat released security updates for OpenShift Container Platform (OCP) release streams 4.13 through 4.22, including **4.19.43**, **4.20.34**, **4.21.29**, and **4.22.10**. The Important-rated updates deliver refreshed packages and container images for x86_64, s390x, ppc64le, and aarch64 deployments, including supported RHEL 8 and RHEL 9 variants. OCP 4.13.70 was rated Low, although its advisory lists fixes affecting the Linux kernel, OpenSSL, and SSSD. The fixes address vulnerabilities in the Linux kernel, Samba, SSSD, ICU, dnsmasq, OpenSSH, libarchive, rsync, Unbound, Vim, and other bundled components. Notable SSSD issues include **CVE-2026-14474**, which can enable privilege escalation through the sudo LDAP provider's directory-wide sudoRole search, and **CVE-2026-14476**, a GPO-cache path traversal flaw that can permit Kerberos authentication bypass. Red Hat advised administrators to upgrade affected clusters through their appropriate OpenShift release channels using the web console or OpenShift CLI.
Aug 25, 2026
Red Hat released security updates across **OpenShift Container Platform**, OpenShift Data Foundation, OpenShift Serverless, distributed tracing, and the Red Hat build of Cryostat. The updates remediate vulnerabilities in shared Go, OpenSSH, networking, image-handling, and third-party libraries that could enable denial of service, resource exhaustion, memory leakage, sensitive-information exposure, or improper privilege propagation. Affected deployments span RHEL 8 and RHEL 9 and supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE architectures. Notable fixes include **CVE-2023-48795** (Terrapin), which permits an active attacker to truncate initial SSH secure-channel messages under vulnerable ChaCha20-Poly1305 or Encrypt-then-MAC configurations, and **CVE-2024-1394**, an RSA error-path memory leak in `golang-fips/openssl` that can cause resource exhaustion. OpenShift Container Platform updates also address a possible OpenSSH remote-code-execution condition on RHEL 9 associated with a signal-handling race. Red Hat advised customers to install relevant prior errata and upgrade clusters and operators through their supported release channels; temporary Terrapin mitigations include disabling `chacha20-poly1305` and EtM MAC algorithms where updates cannot be deployed immediately.
Aug 27, 2026