RHSA-2025:18219HighCVSS 9.1

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.16.0

Published
October 16, 2025
Last Modified
September 1, 2026

🔗 CVE IDs covered (10)

CVE-2025-4517 →CVE-2025-6020 →CVE-2025-6965 →CVE-2025-7425 →CVE-2025-8941 →CVE-2025-49796 →CVE-2025-5914 →CVE-2025-49794 →CVE-2024-12718 →CVE-2025-4138 →

📋 Description

CVE-2024-12718 — cpython: python: Bypass extraction filter to modify file metadata outside extraction directory CVE-2025-4138 — cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory CVE-2025-4517 — python: cpython: Arbitrary writes via tarfile realpath overflow CVE-2025-5914 — libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c CVE-2025-6020 — linux-pam: Linux-pam directory Traversal CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-7425 — libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr CVE-2025-8941 — linux-pam: Incomplete fix for CVE-2025-6020 CVE-2025-49794 — libxml: Heap use after free (UAF) leads to Denial of service (DoS) CVE-2025-49796 — libxml: Type confusion leads to Denial of service (DoS)

🎯 Affected products9

  • cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2b91440f3b71bc63e819a3def29e72b31f49878e03fbea67624de6a06925f340_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:691bfc535cb3d22962b0f6dc6fde226b3e70a5d68283ec1846396e3ee0fc7d07_s390x as a component of cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:768bd034b3d9e99e0a6c756fcd7d9ec00759c591569f25cd95cc8cb4eb449184_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:8c7a1ae39e07d9a0d578e1f62df4f05ab54cefe058595077403a9d9bbd0ce8e3_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:1abdfac084e7c86e7a93a19e5cf6b54db79b903bfb7474a42200f753b29eda4b_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:330e8b5ab4841a21f8f5f23cc7fb192197872f11639b12bf4b1e70831f636323_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df852ad92734bc087e213e6c7075daf6d7010db4ab72919649736804e295a6a2_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.16
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:ec9c6b34a40da29f3ee89b361d94879025a998d34309bf3b63c555f3c225eb16_s390x as a component of cert-manager operator for Red Hat OpenShift 1.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat recommends upgrading to a fixed release of Python as soon as one is available. This vulnerability can be mitigated by rejecting links inside tarfiles that use relative references to the parent directory. The upstream advisory provides this example code: ''' # Avoid insecure segments in link names. for member in tar.getmembers(): if not member.islnk(): continue if os.pardir in os.path.split(member.linkname): raise OSError("Tarfile with insecure segment ('..') in linkname") # Now safe to extract members with the data filter. tar.extractall(filter="data") ''' Workaround: Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`. Workaround: There's no available mitigation other than avoid processing untrusted XML documents before updating to the libxml version containing the fix. Workaround: There's no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library.

🔗 References (14)