RHSA-2025:19046

Vulnerability from csaf_redhat - Published: 2025-10-29 09:26 - Updated: 2026-01-22 16:47
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.18.27 bug fix and security update

Notes

Topic
Red Hat OpenShift Container Platform release 4.18.27 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.27. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/155476 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c (CVE-2025-5914) * unbound: Unbound Cache poisoning (CVE-2025-5994) * sqlite: Integer Truncation in SQLite (CVE-2025-6965) * podman: Podman kube play command may overwrite host files (CVE-2025-9566) * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794) * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.18.27 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.18.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.18.27. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/155476\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nSecurity Fix(es):\n\n* libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c (CVE-2025-5914)\n* unbound: Unbound Cache poisoning (CVE-2025-5994)\n* sqlite: Integer Truncation in SQLite (CVE-2025-6965)\n* podman: Podman kube play command may overwrite host files (CVE-2025-9566)\n* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)\n* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:19046",
        "url": "https://access.redhat.com/errata/RHSA-2025:19046"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2370861",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861"
      },
      {
        "category": "external",
        "summary": "2372373",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373"
      },
      {
        "category": "external",
        "summary": "2372385",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"
      },
      {
        "category": "external",
        "summary": "2380149",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
      },
      {
        "category": "external",
        "summary": "2380949",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380949"
      },
      {
        "category": "external",
        "summary": "2393152",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393152"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-62810",
        "url": "https://issues.redhat.com/browse/OCPBUGS-62810"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19046.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.18.27 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-01-22T16:47:00+00:00",
      "generator": {
        "date": "2026-01-22T16:47:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.15"
        }
      },
      "id": "RHSA-2025:19046",
      "initial_release_date": "2025-10-29T09:26:54+00:00",
      "revision_history": [
        {
          "date": "2025-10-29T09:26:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-10-29T09:26:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-22T16:47:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.18",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.18",
                  "product_id": "9Base-RHOSE-4.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-418.94.202510230424-0",
                "product": {
                  "name": "rhcos-aarch64-418.94.202510230424-0",
                  "product_id": "rhcos-aarch64-418.94.202510230424-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202510230424?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-418.94.202510230424-0",
                "product": {
                  "name": "rhcos-ppc64le-418.94.202510230424-0",
                  "product_id": "rhcos-ppc64le-418.94.202510230424-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202510230424?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-418.94.202510230424-0",
                "product": {
                  "name": "rhcos-s390x-418.94.202510230424-0",
                  "product_id": "rhcos-s390x-418.94.202510230424-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202510230424?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-418.94.202510230424-0",
                "product": {
                  "name": "rhcos-x86_64-418.94.202510230424-0",
                  "product_id": "rhcos-x86_64-418.94.202510230424-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@418.94.202510230424?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-418.94.202510230424-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0"
        },
        "product_reference": "rhcos-aarch64-418.94.202510230424-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-418.94.202510230424-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0"
        },
        "product_reference": "rhcos-ppc64le-418.94.202510230424-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-418.94.202510230424-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0"
        },
        "product_reference": "rhcos-s390x-418.94.202510230424-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-418.94.202510230424-0 as a component of Red Hat OpenShift Container Platform 4.18",
          "product_id": "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
        },
        "product_reference": "rhcos-x86_64-418.94.202510230424-0",
        "relates_to_product_reference": "9Base-RHOSE-4.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-5914",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2025-06-06T17:58:25.491000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2370861"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has rated this vulnerability as Important because it allows a local attacker with limited privileges to trigger a double-free in libarchive\u0027s RAR parser by providing a specially crafted RAR archive. Successful exploitation could result in code execution or application crashes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-5914"
        },
        {
          "category": "external",
          "summary": "RHBZ#2370861",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-5914",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5914"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5914",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5914"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2598",
          "url": "https://github.com/libarchive/libarchive/pull/2598"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0",
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        }
      ],
      "release_date": "2025-05-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-29T09:26:54+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is {x864_DIGEST}\n\n      (For s390x architecture)\n      The image digest is {s390x_DIGEST}\n\n      (For ppc64le architecture)\n      The image digest is {ppc64le_DIGEST}\n\n      (For aarch64 architecture)\n      The image digest is {aarch64_DIGEST}\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19046"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c"
    },
    {
      "cve": "CVE-2025-5994",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "discovery_date": "2025-07-16T15:01:36.497027+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2380949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cache poisoning flaw was found in Unbound. Resolvers supporting EDNS Client Subnet (ECS) must segregate outgoing queries to accommodate different outgoing ECS information. This issue reopens resolvers to a birthday paradox attack, known as the Rebirthday Attack, which attempts to match the DNS transaction ID with cache non-ECS poisoned replies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "unbound: Unbound Cache poisoning",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is considered Important rather than Moderate because it directly compromises the integrity of DNS caching mechanisms in resolvers supporting EDNS Client Subnet (ECS). The flaw allows an attacker to exploit the birthday paradox by generating a high volume of concurrent queries with different ECS values, thereby increasing the chance of a transaction ID collision with a spoofed response. If the resolver fails to properly segregate cache entries by ECS scope, it may accept and cache a malicious non-ECS response, effectively leading to DNS cache poisoning. Unlike typical poisoning attempts that require precise timing or privileged network positions, this attack can be carried out remotely with a high success rate, especially in resolvers that do not correctly isolate ECS queries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-5994"
        },
        {
          "category": "external",
          "summary": "RHBZ#2380949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-5994",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-5994"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5994",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5994"
        },
        {
          "category": "external",
          "summary": "https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt",
          "url": "https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt"
        }
      ],
      "release_date": "2025-07-16T14:38:22.738000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-29T09:26:54+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is {x864_DIGEST}\n\n      (For s390x architecture)\n      The image digest is {s390x_DIGEST}\n\n      (For ppc64le architecture)\n      The image digest is {ppc64le_DIGEST}\n\n      (For aarch64 architecture)\n      The image digest is {aarch64_DIGEST}\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19046"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "unbound: Unbound Cache poisoning"
    },
    {
      "cve": "CVE-2025-6965",
      "cwe": {
        "id": "CWE-197",
        "name": "Numeric Truncation Error"
      },
      "discovery_date": "2025-07-15T14:02:19.241458+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2380149"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: Integer Truncation in SQLite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in SQLite is categorized as Important rather than Critical because, although it involves memory corruption, the conditions required to trigger it are relatively constrained. The flaw arises when a query causes the number of aggregate terms to exceed internal limits, leading to potential buffer overflows or memory mismanagement. However, exploitation requires the ability to craft complex SQL queries and interact with the SQLite engine in a specific manner\u2014typically through direct SQL input. There is no known evidence of arbitrary code execution, privilege escalation, or remote exploitability as a direct result of this flaw. Additionally, most SQLite deployments are embedded in applications where input is tightly controlled or sanitized.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-6965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2380149",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-6965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
        },
        {
          "category": "external",
          "summary": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8",
          "url": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"
        }
      ],
      "release_date": "2025-07-15T13:44:00.784000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-29T09:26:54+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is {x864_DIGEST}\n\n      (For s390x architecture)\n      The image digest is {s390x_DIGEST}\n\n      (For ppc64le architecture)\n      The image digest is {ppc64le_DIGEST}\n\n      (For aarch64 architecture)\n      The image digest is {aarch64_DIGEST}\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19046"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: Integer Truncation in SQLite"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Paul Holzinger"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2025-9566",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2025-09-04T15:45:46.448000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2393152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There\u0027s a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.\n\nBinary-Affected: podman\nUpstream-version-introduced: v4.0.0\nUpstream-version-fixed: v5.6.1",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "podman: Podman kube play command may overwrite host files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has evaluated this vulnerability as having the Important severity. This happens because of the consequences of an successful attack and the low complexity (AC:L) on exploiting this vulnerability. Although the attacker cannot control the content written to the target file, depending on which file was targeted, the exploitation of this flaw may lead sensitive data corruption (I:H) and leading the system to crash resulting in a Denial of Service attack (A:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9566"
        },
        {
          "category": "external",
          "summary": "RHBZ#2393152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9566",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9566"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9566",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9566"
        }
      ],
      "release_date": "2025-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-29T09:26:54+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is {x864_DIGEST}\n\n      (For s390x architecture)\n      The image digest is {s390x_DIGEST}\n\n      (For ppc64le architecture)\n      The image digest is {ppc64le_DIGEST}\n\n      (For aarch64 architecture)\n      The image digest is {aarch64_DIGEST}\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19046"
        },
        {
          "category": "workaround",
          "details": "Red Hat advises to not run the podman kube play command with untrusted Kubernetes YAML file as input, additionally review the Kubernetes YAML file before running it through podman may help to catch maliciously crafted secretes or volumes that may be used to exploit this vulnerability.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "podman: Podman kube play command may overwrite host files"
    },
    {
      "cve": "CVE-2025-49794",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2025-06-11T21:33:43.044000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372373"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u003csch:name path=\"...\"/\u003e schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0027s crash using libxml or other possible undefined behaviors.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml: Heap use after free (UAF) leads to Denial of service (DoS)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue was rated with a severity impact of Important by Red Hat Product Security, as libxml can be used to parse XML coming from the network depending on how the program consumes it and uses the library. Additionally, although the initial report shows a crash due to invalid memory access (A:H), other undefined issues that can present data integrity due to the application overwriting sensitive data are not discarded (I:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49794"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372373",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49794",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49794"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794"
        }
      ],
      "release_date": "2025-06-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-29T09:26:54+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is {x864_DIGEST}\n\n      (For s390x architecture)\n      The image digest is {s390x_DIGEST}\n\n      (For ppc64le architecture)\n      The image digest is {ppc64le_DIGEST}\n\n      (For aarch64 architecture)\n      The image digest is {aarch64_DIGEST}\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19046"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation other than avoid processing untrusted XML documents before updating to the libxml version containing the fix.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml: Heap use after free (UAF) leads to Denial of service (DoS)"
    },
    {
      "cve": "CVE-2025-49796",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-06-12T00:35:26.470000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372385"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml: Type confusion leads to Denial of service (DoS)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has evaluated this vulnerability as having an Important security impact, as libxml can be used to parse XML from the network depending on how the program consumes it using the library. Additionally, although the initial report shows a crash due to invalid memory access (A:H), other undefined issues that can present data integrity due to the application overwriting sensitive data are not discarded (I:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
          "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-49796"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372385",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-49796",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49796"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796"
        }
      ],
      "release_date": "2025-06-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-29T09:26:54+00:00",
          "details": "For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is {x864_DIGEST}\n\n      (For s390x architecture)\n      The image digest is {s390x_DIGEST}\n\n      (For ppc64le architecture)\n      The image digest is {ppc64le_DIGEST}\n\n      (For aarch64 architecture)\n      The image digest is {aarch64_DIGEST}\n\nAll OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19046"
        },
        {
          "category": "workaround",
          "details": "There\u0027s no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library.",
          "product_ids": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.18:rhcos-aarch64-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-ppc64le-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-s390x-418.94.202510230424-0",
            "9Base-RHOSE-4.18:rhcos-x86_64-418.94.202510230424-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml: Type confusion leads to Denial of service (DoS)"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.