Red Hat AI Base Images 3.4.3 Fix Vulnerabilities Across Nine Variants
Tech GuruQuick Answer
Red Hat AI Base Images 3.4.3 updates nine OpenShift AI 3.4 variants. Select the advisory for the actual CPU or accelerator image and architecture. The 83-CVE list below is the combined scope, not a statement that every variant has 83 vulnerable components. Rebuild derived images and redeploy affected workloads; changing a base-image tag alone does not replace running containers.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Red Hat OpenShift AI 3.4 CPU, Gaudi, Neuron, Spyre, TPU, CUDA 12.9, CUDA 13.0, ROCm 6.4, and ROCm 7.1 base images, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenShift AI 3.4 CPU, Gaudi, Neuron, Spyre, TPU, CUDA 12.9, CUDA 13.0, ROCm 6.4, and ROCm 7.1 base images |
|---|---|
| Advisory | RHSA-2026:74674 / RHSA-2026:74677 / RHSA-2026:74678 / RHSA-2026:74679 / RHSA-2026:74681 / RHSA-2026:74683 / RHSA-2026:74685 / RHSA-2026:74687 / RHSA-2026:74688 |
| CVEs | CVE-2023-52355, CVE-2024-34459, CVE-2025-10911, CVE-2025-14087, CVE-2025-14512, CVE-2025-6170, CVE-2026-10118, CVE-2026-11822, CVE-2026-11824, CVE-2026-11940, CVE-2026-12912, CVE-2026-14164, CVE-2026-15308, CVE-2026-15588, CVE-2026-16118, CVE-2026-26740, CVE-2026-29111, CVE-2026-31790, CVE-2026-33416, CVE-2026-33636, CVE-2026-33845, CVE-2026-33846, CVE-2026-34588, CVE-2026-34982, CVE-2026-35177, CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414, CVE-2026-3833, CVE-2026-39979, CVE-2026-40164, CVE-2026-40356, CVE-2026-41142, CVE-2026-41411, CVE-2026-41989, CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012, CVE-2026-42013, CVE-2026-42014, CVE-2026-42015, CVE-2026-42216, CVE-2026-44431, CVE-2026-44432, CVE-2026-46483, CVE-2026-47162, CVE-2026-47167, CVE-2026-4775, CVE-2026-4786, CVE-2026-4878, CVE-2026-48864, CVE-2026-5260, CVE-2026-52858, CVE-2026-5419, CVE-2026-54369, CVE-2026-54411, CVE-2026-5450, CVE-2026-55693, CVE-2026-55971, CVE-2026-57455, CVE-2026-57456, CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015, CVE-2026-58016, CVE-2026-59856, CVE-2026-59858, CVE-2026-60002, CVE-2026-6100, CVE-2026-6477, CVE-2026-64830, CVE-2026-73066, CVE-2026-73072, CVE-2026-73076, CVE-2026-73077, CVE-2026-73078, CVE-2026-8643 |
| Authoritative release date | 2026-10-01 20:54:01 UTC |
| Authority revision date | Latest current_release_date in the checked advisory set: 2026-10-02T17:42:35+00:00. Individual advisories may have earlier revisions. |
| Affected versions | The advisory-listed OpenShift AI 3.4 base-image digests before the 3.4.3 builds. |
| Fixed version | Red Hat AI Base Images 3.4.3; select the matching advisory repository, architecture and product_status.fixed digest. A digest identifies content; signature verification is a separate provenance check. |
| CVSS base score | 2.2–8.8 (official CVSS v3.1 range) |
| CVSS severity | Low to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The mapping is Neuron: 74674; TPU: 74677; Gaudi: 74678; CPU: 74679; Spyre: 74681; CUDA 13.0: 74683; CUDA 12.9: 74685; ROCm 7.1: 74687; ROCm 6.4: 74688 (all RHSA-2026). The records contain different component sets and architecture-specific digests. Keep accelerator/runtime requirements aligned with the selected variant rather than swapping to an unrelated image to clear a finding.
What To Validate Now
- Inventory. Locate Red Hat OpenShift AI 3.4 CPU, Gaudi, Neuron, Spyre, TPU, CUDA 12.9, CUDA 13.0, ROCm 6.4, and ROCm 7.1 base images deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match entitlement, product stream, architecture, source package or image repository, and each advisory's product status. Do not apply one branch's build or digest to another branch.
- Remediate. Use the official supported registry/advisory mapping, verify image provenance through the approved registry policy, and rebuild application images that inherit the affected base. Pin the resulting deployment image digest and roll out deliberately. Installing updates in a disposable running container is not a durable rebuild.
- Validate. Record both the selected base digest and rebuilt application digest, then confirm the actual running image. Run a small authorized inference or training smoke job with the required accelerator, storage and model-loading path; compare errors and output validity without inventing a throughput benchmark.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Confirm entitlement and branch support, test package or image compatibility, drain and redeploy clustered workloads deliberately, preserve prior digests and rollback evidence, and do not infer exploitation from severity.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- RHSA-2026:74674
- RHSA-2026:74677
- RHSA-2026:74678
- RHSA-2026:74679
- RHSA-2026:74681
- RHSA-2026:74683
- RHSA-2026:74685
- RHSA-2026:74687
- RHSA-2026:74688
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
