SB2026012253 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
Published: January 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Uncontrolled Recursion (CVE-ID: CVE-2025-9714)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uncontrolled recursion in XPath evaluation within the xmlXPathRunEval() function in xpath.c. A remote attacker can pass specially crated XML data to the application and perform a denial of service (DoS) attack.
2) Resource exhaustion (CVE-ID: CVE-2025-59375)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.
3) Improper privilege management (CVE-ID: CVE-2025-11561)
The vulnerability allows a remote user to bypass authorization checks.
The vulnerability exists due to improper privilege management within the Active Directory integration feature. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2025-40778)
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to insufficient verification of data authenticity when accepting records from answers. A remote attacker can inject forged data into the cache leading to DNS cache poisoning.
5) Predictable Seed in Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2025-40780)
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to weakness in the Pseudo Random Number Generator (PRNG). A remote attacker can predict the source port and query ID that BIND will use and perform DNS cache poisoning attacks.
6) Resource exhaustion (CVE-ID: CVE-2025-8677)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when querying for data within a specially crafted zone containing certain malformed DNSKEY records. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.