SB20250521147 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20250521147

SB20250521147 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15

Published: May 21, 2025 Updated: July 3, 2025

Security Bulletin ID SB20250521147
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2025-22869)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the ssh package when handling clients that complete the key exchange slowly, or not at all. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.


2) Input validation error (CVE-ID: CVE-2024-47745)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the SYSCALL_DEFINE5() function in mm/mmap.c. A local user can perform a denial of service (DoS) attack.


3) Input validation error (CVE-ID: CVE-2024-53141)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bitmap_ip_uadt() function in net/netfilter/ipset/ip_set_bitmap_ip.c. A local user can perform a denial of service (DoS) attack.


4) Exposed dangerous method or function (CVE-ID: CVE-2024-53920)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation in elisp-mode.el. A remote attacker can trick the victim into invoking elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code, trigger unsafe Lisp macro expansion and execute arbitrary code on the system.


5) Use-after-free (CVE-ID: CVE-2025-21756)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the EXPORT_SYMBOL_GPL() and __vsock_release() functions in net/vmw_vsock/af_vsock.c. A local user can escalate privileges on the system.


Remediation

Install update from vendor's website.

References