RHSA-2025:10853HighCVSS 8.2

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.19.0

Published
July 14, 2025
Last Modified
August 16, 2026

🔗 CVE IDs covered (3)

CVE-2024-11831 →CVE-2024-21536 →CVE-2024-48949 →

📋 Description

CVE-2024-11831 — npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript CVE-2024-21536 — http-proxy-middleware: Denial of Service CVE-2024-48949 — elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

🎯 Affected products117

  • Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:1b5fecd9fa31f82801480ee4f3b8e27eeb0a6d5ff53812a4f30c1974a0604c6d_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:54d4ac4dd872a48ccf057260a3abb8a984a03676ecf34583521dee3414ab04ad_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:6d560e78faca831db02460d27a429ffcc9ff152d0a984be6120efa5041b77507_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:d08688386f39dc6a24b89799191a2ca9780391fd2303da228da1e822c8f676b0_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:8f20d3b6cd3c27aabdb7e7b43bbe45762806dfadcd94d9f679576b5badab6ad8_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:e9843b9e6f76f98f1d9e87bdaa47f3956cc82923bb2d1f56502c704713c6fc21_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:f1a3ab359164af876e8dedaee38ce894c75c21caad1bd1d75d57910e3864a445_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:fdd13132e5979a560ed4c767382e3e3a0c4b79a2181cda2e78fd007e2c34ec49_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:31eeeab213a1b603ab8c3f8253cd19c87bb45ca03e96e0461314571a7de82828_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:41802fe9a757e2619392b014e573c921e38ecec28ba8c1cf19e31e3f8340606f_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:558719ae3da2bac49de6c06ec717ddaedd19183f2da491a87268c6d498a5a8bf_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:996376e94e4c20d34e6381b3f3c57cedf5974ec7630803f6b417b894e492244c_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:40ef8f679897d4b0e3998c68459460c061ad057f427c2f9e784eca947c797a86_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:8bf67b393bbff44d480698a1f34e8f717f03bba8c8fecd4586b5a91489b0af6b_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:b3e0a825b32628a35d979452bbb2582d58ae8c9250dccd47f0f1ab193b00f852_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:e3481359cf196d886838060ce43018c1c38d9a232fde4eb6be01288b1997df86_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:44d470df1b2343a0b544813bfdcd32c4fa834c145c693e15f2943dc650eb8683_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:9f44ac3efa908433cf4adb0f581d6bf6f6726ebae00ff59646969213dc4be685_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:d5ae782bc5d8afa18402413ed9ce8c5bb3a7113df4c65b6417c0c6f87fce81aa_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:deddb032b31451ce5585ebfdbdf9b8cf64bbde09328a0bd26f45b824fd90f61c_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:2195f03696fce4657a021413ba5ad42004492f4a72f2e628fa8875fa4bcacd8b_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:5298ebc6a48fbb96ca6985740eb3587bc50bf59a4d0ad84984a5b86403e843cc_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:5bacab977cb40ab8157ba5948e1bd632d5272480bcbaf261ea2251bb5e174d5a_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:6e31c07d9952b925c766e61d5f1683c31461f80ff2f5f5494bf195757141178c_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:0dbb3b16a6107f57f53f72fe7c78c286b386fd127288b1fd65f44d08fdbfaa2c_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:0f7e9e8c45e88aef5d41f301ec04dc34dd79ef07912b8378f6b590e3142a1847_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:332a51faa4208ca5f4749b7665f7eb7c42e99d8637edafe66d0c88da43cc5b2a_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:4acdbbb940083c0f4e3af524383e24f410a93a9bac32e67714d682142de36e1f_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:1938d8854f3379b40ab024975843f5de448ac20297c6d53426f3b4321f43cfff_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • +87 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat Product Security does not have any mitigation recommendations at this time.

🔗 References (7)