SB20260114134 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
Published: January 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2025-8677)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when querying for data within a specially crafted zone containing certain malformed DNSKEY records. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Insufficient verification of data authenticity (CVE-ID: CVE-2025-40778)
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to insufficient verification of data authenticity when accepting records from answers. A remote attacker can inject forged data into the cache leading to DNS cache poisoning.
3) Predictable Seed in Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2025-40780)
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to weakness in the Pseudo Random Number Generator (PRNG). A remote attacker can predict the source port and query ID that BIND will use and perform DNS cache poisoning attacks.
4) Resource exhaustion (CVE-ID: CVE-2025-59375)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.
5) Out-of-bounds write (CVE-ID: CVE-2025-9230)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when trying to decrypt CMS messages encrypted using password based encryption. A remote attacker can trigger an out-of-bounds write and execute arbitrary code on the target system.
Successful exploitation of the vulnerability requires that password based (PWRI) encryption support in CMS messages is enabled.
Remediation
Install update from vendor's website.