RHSA-2025:8544 - Security Advisory

Topic

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.15.14 on Red Hat Enterprise Linux 9 from Red Hat Container Registry.

Description

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multi-cloud data management service with an S3 compatible API.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Data Foundation 4 for RHEL 9 x86_64
• Red Hat OpenShift Data Foundation for IBM Power, little endian 4 for RHEL 9 ppc64le
• Red Hat OpenShift Data Foundation for IBM Z and LinuxONE 4 for RHEL 9 s390x
• Red Hat OpenShift Data Foundation for RHEL 9 ARM 4 aarch64

Fixes

• BZ - 2270863 - CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to file leak
• BZ - 2290901 - CVE-2024-29041 express: cause malformed URLs to be evaluated
• BZ - 2292777 - CVE-2024-37890 nodejs-ws: denial of service when handling a request with many HTTP headers
• BZ - 2295035 - CVE-2024-39249 nodejs-async: Regular expression denial of service while parsing function in autoinject
• BZ - 2311171 - CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
• BZ - 2312579 - CVE-2024-11831 npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript
• BZ - 2319884 - CVE-2024-21536 http-proxy-middleware: Denial of Service
• BZ - 2322949 - CVE-2024-48910 dompurify: DOMPurify vulnerable to tampering by prototype pollution
• BZ - 2324550 - CVE-2024-21538 cross-spawn: regular expression denial of service
• BZ - 2333122 - CVE-2024-45338 golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
• BZ - 2348366 - CVE-2025-22868 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
• BZ - 2354195 - CVE-2025-30204 golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
• DFBUGS-1034 - [2313424] [4.15] [GSS] MDSCacheUsageHigh alert firing
• DFBUGS-2604 - [Critical] Upgrade ceph version to RHCEPH-7.1z4 at ODF-4.15.14

CVEs

• CVE-2023-23934
• CVE-2023-25577
• CVE-2023-46446
• CVE-2023-48795
• CVE-2024-8176
• CVE-2024-11831
• CVE-2024-21536
• CVE-2024-21538
• CVE-2024-24790
• CVE-2024-29041
• CVE-2024-29180
• CVE-2024-34069
• CVE-2024-37890
• CVE-2024-39249
• CVE-2024-42353
• CVE-2024-45338
• CVE-2024-45590
• CVE-2024-47191
• CVE-2024-48910
• CVE-2024-48916
• CVE-2025-0395
• CVE-2025-22868
• CVE-2025-27516
• CVE-2025-30204

References

• https://access.redhat.com/security/updates/classification/#important