RHSA-2025:17730HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.16.4 security update

Published
October 9, 2025
Last Modified
September 5, 2026

🔗 CVE IDs covered (6)

CVE-2025-22874 →CVE-2025-47907 →CVE-2025-55191 →CVE-2025-59531 →CVE-2025-59537 →CVE-2025-59538 →

📋 Description

CVE-2025-22874 — crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-55191 — github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race condition leading to crash CVE-2025-59531 — argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload CVE-2025-59537 — github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service CVE-2025-59538 — github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service

🎯 Affected products38

  • Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:24d8c9b3d5e2302d86a6522bb8997cdf203a1121825a1a84834a58c972561334_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:2e056fd5830a22ec87570415ee3621a8951386f86286970d21fcf76f5eb40a5b_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:4dff7f7534e02fcc989f8c58646acf0a8de6eb950514a9eaebe0d4db7f799bb8_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:f505ecf3600e5f453867a4c9986c814ff774738387b135b881bbefdb64a8b6c0_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:190f9d93d0383e9d67079af14eacc7d960895883106d58819a2dd928d07df227_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:41b064e75d6e1381582ed9ae018c93b72a0c380a02dc91e542cd8748b4de20b2_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:89b76d9ac08f2d7852e484f5cd3ba7c2aee0f9ff3444eb8a9344474125220042_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:f1ad261aa5b50b368a5a2619ec79e6f1a14b4f218ffc157a5c2e0c8f07c0b007_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:3caf15f8693245181eb1dc3adbf177c3be3095701b4fbb9ab64ec96af345855f_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:989eefed937fc36a100303b24ae8fd4d1a88599a3cd0160cfac77180cc188a3b_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:bdd0a289775ce41a8b495e02626f2e84b39f27d8eab8e351faf13bd46c8bb843_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:c5a94378fa6de06979845d1dd57ee840d1c1e63bdec31a816ad80703dd677c29_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:400f6dc94a40d30e9bf08a6bbbdb69d03bac59f84c4d66620fa7d99b4b5a96f5_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:af6a17b989475611cccb8dde3fc4b04c07d83c808a9e36537e04fc220357836c_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:bc2ef6df807856991b716adea85d114c5f61a6ea02d1d3dddc86ddd61bacab76_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:c9d9ee712c5432f2ddf0985665a1ebc1ab8dfa49ddfd4829fd0eea8cb29c745d_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:0b76c3b83e7ffa1d650fdca227fa18a31a08339828160683ae7ff5a7a0bc6760_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:3a2a9cea446951e9ce350b51197a8a5c01691ec7b5ffc149a66ca9e3134a82a0_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:94e8b2edf66de66d8ed7a9acaeb49ecd11e07f828d0a4be642d87cdedbf6e8a4_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:de943611e032cfc21ffe468a4c5ebf3e4dc843cf33f1d476ed26504445cf3f24_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:645d19854b1ce41c0d260de0b210749453269f7418059be41c854f2e9bbf000c_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:6eb5d4b468ebf1732f466caebba617c30fb406623274a3acf7511805121e1eff_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:efd3f2795152ae8173722eb6695530bc5a986ea2572967038043d67eb65ead0c_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:f1160e0c44027b8a6f04e207020eb2b64683d271cf9153836ecce8c67579463b_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:78dc89a4a9dfb8dcf93224fd9a3caa63ea1551f8da73a88aebb284123d4a2962_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:20eba0b58edf23d29297fd53e76fbc2206f87b7a34ee83e98dcf013802fb6c2b_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:52ffe54a0935e54b8d7712a01f65beb6030524a6bc5ea3ae2f59bc1b75fb5ef7_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:814349bf64d3571529ef554df85dfb765446ce199fd771552b236a88ca56a362_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:c7c68a98f7cf428c7f228a66c85d42ddc709a2bd453c9bcfb47899b7f2e1fed0_s390x as a component of Red Hat OpenShift GitOps 1.16
  • +8 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Systems may be configured to automatically restart a service upon crash and doing so may partially mitigate the availability impact of this vulnerability. Workaround: If a BitBucket repository is being used by GitOps it's possible to mitigate this vulnerability by setting up a BitBucket webhook secret to ensure only trusted parties can access the webhook endpoint. In case BitBucket is not being used, the user can set the webhook secret to a long random value to prevent the webhook from being called: ~~~ apiVersion: v1 kind: Secret metadata: name: argocd-secret type: Opaque data: + webhook.bitbucketserver.secret: <your base64-encoded secret here> ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)