RHSA-2025:22905HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.19.4

Published
December 9, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (5)

CVE-2025-6545 →CVE-2025-6547 →CVE-2025-9287 →CVE-2025-9288 →CVE-2025-64756 →

📋 Description

CVE-2025-6545 — pbkdf2: pbkdf2 silently returns predictable key material CVE-2025-6547 — pbkdf2: pbkdf2 silently returns static keys CVE-2025-9287 — cipher-base: Cipher-base hash manipulation CVE-2025-9288 — sha.js: Missing type checks leading to hash rewind and passing on crafted data CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames

🎯 Affected products117

  • Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:3db810d168a5a106e894b3bd701b32af7821f55e83713e98dcc7c3fc19ae0c41_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:914e831a771ccb36b6ef46bf4ced2c05ce2a76a538b3a6785cf047d1782c354c_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:f869e6005bb36b9d0f2e565059c228b6967b33dc463b69de1dcc6f263e07b1e6_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:f8baf73dbf01840d3926d1f259128b2595f221fa0db8e7f0ad54c0c6b2b5a532_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:01d0bac5ae68324714889caad7a6d00974a194706dd6abac16ac600c1acba486_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:39ce75c550fd693dc0bf2ded4e8d15e20e6b8ba7fe63f095d0642c44d3bf3ed5_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:42c27a9a4546aeff7d88be0e1a3a47f23d738b3184b87c09c769fbb2b189d5b8_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:5c786e81facc28108221a2a85e2811b145c4ac5cc0c9c5d1c8b79f518dfc42c2_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:1f3da51efb5c0f7d6ce15ad8b76641a65d6d09be940346f9b5ff833453018ed0_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:2ae4928be71ff1fb0adfb8d014e079c912445a53473400881ac9299332694b80_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:9317d326fc72e99e821a4891e115007761d326f33ee85dbfe3cc62be801d5af6_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:a4ab9fd58865390a4a6d85dc2d91505737539fb547e2b17c57cb72be0acbcf0a_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:1a7f6edbd72dd5e86ca19dd3b57987362dbc17aad5b4bf07eb259ada71c270c9_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:5bdbe4eeced5d4e13831125bb704c8d7e98cd1fd4cc335a39e204a8676f317eb_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:887df82ba16869a9fdf336577a7f7ae9a90713dfbcaa8321f9ec45a20637cc5a_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:dbf71dcf74dd47cbfc5f285640aca82afa3686e98ef32bc025dd3d047d636671_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:068909009a477b980a6b50396a168b1a62235dd203e63a5f11065bb053fbd89c_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:192657fb34d498d7b731e3852abf89265257f7421e1787bd8fde0019805dc823_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:7b2727015d5b29531155977c8bed5422612614d694e28e8a01325340bf7a7410_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:7b2e55ea36197d0e733baea29aa6671ec5b0055a1f58fabb5269d31bf04d8045_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:169b8f0623a6a15aefb7217228197218b4ab9a398cbab01348f9045599c38a57_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:8736b16bee608eba7c8506963419149631fe93bdf30b71c3785391e01b803ba5_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:acbca5c8ed3a1947bea2fda696d84e799fea859e24c4f04256dc7e080fa3e1cf_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:fe1af3bd9efe149c6567a5f14a5b48e2b1b9f41997b081b18cab513b59b55e87_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:03ff8b2feccd7a7fc5b93574042def602fa885e572919674fccb1e516bd6969f_ppc64le as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:28097a799be3dd6d8f500aee2d0ae2ec2a7ccc8a3d2a96a1a4f314a6621ced93_arm64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:4b0c865ca819b32dedd280dc301e719f0efa14e054dd82e43097837ef2627e3f_s390x as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:8fe90449d2c94b550e5cac06207d9b65a64683f0878e857cee4a24b94c1b8bf2_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:6f879fcc0f49dd55a32a2394fb366a07fc9d53b7bf90638f7427b08e700efa1a_amd64 as a component of Red Hat OpenShift Pipelines 1.19
  • +87 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled.

🔗 References (9)