RHSA-2025:21913HighCVSS 9.1

Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update

Published
November 21, 2025
Last Modified
September 1, 2026

🔗 CVE IDs covered (6)

CVE-2025-7425 →CVE-2025-49794 →CVE-2025-49796 →CVE-2025-54389 →CVE-2025-5914 →CVE-2025-6965 →

📋 Description

CVE-2025-5914 — libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-7425 — libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr CVE-2025-49794 — libxml: Heap use after free (UAF) leads to Denial of service (DoS) CVE-2025-49796 — libxml: Type confusion leads to Denial of service (DoS) CVE-2025-54389 — aide: improper output neutralization enables bypassing

🎯 Affected products5

  • File Integrity Operator 1
  • registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:7520e7694e24b0de7e904f1833f9de1bd147eba17cda43aaece3a4df259e6a73_amd64 as a component of File Integrity Operator 1
  • registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:364d11af112a5b1d3f28c9ea8b7aac678e111b9c7fca0516d61036904f318605_ppc64le as a component of File Integrity Operator 1
  • registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:59fcdf4ea159ba76fdb582011263672646dd9d63304a91592c0a21d0f43986a4_s390x as a component of File Integrity Operator 1
  • registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:86d2378dea6c26da92e19e1a8dc9c9fb0fa8587fd60f83e6cc4503153e753db9_amd64 as a component of File Integrity Operator 1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: There's no available mitigation other than avoid processing untrusted XML documents before updating to the libxml version containing the fix. Workaround: There's no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (9)