RHSA-2025:17731HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.2 security update

Published
October 9, 2025
Last Modified
September 17, 2026

🔗 CVE IDs covered (6)

CVE-2025-55191 →CVE-2025-59531 →CVE-2025-59537 →CVE-2025-59538 →CVE-2025-22874 →CVE-2025-47907 →

📋 Description

CVE-2025-22874 — crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-55191 — github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race condition leading to crash CVE-2025-59531 — argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload CVE-2025-59537 — github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service CVE-2025-59538 — github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:a03e72ceb733c34a4788d294d14f0e4ee0e03e2b509a4f7e78f4abebe4d8224a_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:a0686e82d2d203e6af794691ba50101aa9a1fb049523cc50aa0a870bdcae4113_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:c28cabf7a7e417448c23bed8741d86cec7a60b70598672a8766279ea67a7d570_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:e5c9119e2417f4085ad78a71653ec1653096923672d03b4d8a384334dca20a90_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:1dd0c50f25497541f3b4e35b802ed9110987870d38960bda7d530436f7875e73_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:1f35c7ec22e6cb4c4d1e5da664a4b4fdd6e4b9fe98c93e9f5f6e9b16dcc12ff5_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:a182f8ec61c4dc5f32a87750e28b792d0ff3b666ae9d67a39ac9dc6e2bc84e5e_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:a73d1a81029d39de7900b5c52f22bcb57188d973391c4a2f81bbde612b9185fb_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:1eb401fa44278a8558d45167b3d2507fac77521a2fb322bb66012d4cdfec87b6_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:5109b457be26c5d03311c5fa52f43d4db7606ecae58360a479fa8562d808fadc_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:b6c7ce8543542a2943498c7cc5f3be103493d7c8a3055dfbfe4b468285542cc7_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:faa950d8512bc45382646c6c7d403ebf91fcd47d8ca65f4124fed91e77bebf2e_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:12e0ab863663d47e2a483839e000eb8fa624bd5766bf706213db295a0e00815f_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:4b3765fa97fcf85c39a17e88712fdd1bfa158a8677f714e862d35cadedeeda62_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:99403da3c050737dbda083bb11d413b317fa2cb7143ee4ce0125fb6ad44ca184_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:a2339147b13271b43dfd58901f09ed024a5f8d1ad1def8639c416710d68f1ca3_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:54f6d32f5aa8ad998eb98ef2035b7593704cca8db98251ff77405801920e324b_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:9ef69c345cfa9198e4d56366946741f83413e0cc1e63a95104a5dd476805e78d_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:b9125f40d94e6aa05df7814a23d47e904ccee9f5204ebcfd994f9432b3feb0fb_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:c7b52016e71fc0b1118e0253840f261c0d21a64a9135b5f7971cb6dab3dcc285_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:8fd8642fc3d8133141119dd425bc78bb57be51360cb3c28cc1b54968e79b6b55_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:a4b698bd79e935b61cfc559ac512fd1e634d6f347a6afe335161de3325a164ab_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:a85ac1be1b1879662d4cec1033d6916f4c142221282aff09113383ba236a2bdb_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:af6d72cac08a08cc48d446e426fe1e34e21d71a7779dafdbea08173be063149f_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:439fef0be72eb98010e262668a420425c4b74924c3a929dcbac987de1341d8e6_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:47c66c140471b49a4e95bc25788d261e8951eeec2a55ea5d07b8a3670a393ef6_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:64d8c57090f88ebd3671a390e1b1956f799cda24c85e978d8f937f302ceb40f5_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:ba88e66dc3f39019be91230d122ee73e0b0b931a6d3c7d7130f2a7dbb0d4c553_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:4fc82c51692138acd9a7232fc4b3451cbca9f7be763452c811bea7a68867cb93_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Systems may be configured to automatically restart a service upon crash and doing so may partially mitigate the availability impact of this vulnerability. Workaround: If a BitBucket repository is being used by GitOps it's possible to mitigate this vulnerability by setting up a BitBucket webhook secret to ensure only trusted parties can access the webhook endpoint. In case BitBucket is not being used, the user can set the webhook secret to a long random value to prevent the webhook from being called: ~~~ apiVersion: v1 kind: Secret metadata: name: argocd-secret type: Opaque data: + webhook.bitbucketserver.secret: <your base64-encoded secret here> ~~~ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)