RHSA-2025:23203HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.2 security update

Published
December 15, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (3)

CVE-2025-49844 →CVE-2024-45337 →CVE-2025-13888 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2025-13888 — openshift-gitops-operator: OpenShift GitOps: Namespace Admin Cluster Takeover via Privileged Jobs CVE-2025-49844 — Redis: Redis Lua Use-After-Free may lead to remote code execution

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:217cfb3efa9a3514fec28db7c812c723c0d490b2653920f690e89bec64bb8a17_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:2d7214b91d8954376fa3739b5d0a856f0124a62e2cd135bbe0a2fd741efed1a9_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:87a36dcde955efb54ab113d5696d2eed8d6f0f34dad48303abd2fbb00b5d0265_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:fbdcd572a787c37403839d12ec627f371731b55bf665558e9621dbc6951e2df1_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:421639cedef9b144be97d27d1fdfa46d7fe9f01611a9625656868ca7a4d5ce11_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:7adcbe9c60d6a10435ae86fe475241148621b9375866125cc35a9ad889886b38_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:8a904ab9ff98789f9a7d1ccb93f1d5696ec60386240655963fe9268922924ef6_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:ee50a4291ea3401f1c4739b554b100815c51191f8bfbee60cccfc7df7830c8aa_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:012098b3e2a9d10ad6b10bbfe8c79d60202b514395b7ee1f63586c6ebd399e34_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:36846a0a80043b3047d361b3114c65e7dd8bcedf7f296f8d58b872b0f34c2aa8_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:453961c36353116685d096503997af51b5551327e58060142c6cc8e519593179_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:aa1f6651fe44e8954ec4ff9e54e30cd1567a79f264f1ac2655190aa3507c2600_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:2c803534984353a1fffb3cb6dc1cc060bb49a777eff5d29ab73e886aa9c7ad9e_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:3759356a7e66dc3ded63c8df2fdaaa425621ea26aebb4ecbdab38398b1b8287e_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:63a009eef474539e273c2aedbd50cdb160bcff8ef6ece067a5d9a492b17c7e42_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:a6cc862075088ed8fa87795ec7f04f232758f7ac198659edf1f2e31218380cf9_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1ce4994bf13f82da293b7fe2829302951f812cc09139434dc06e492e0f8e5cb8_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:4620ae80d5890bcb11b2ca68e0dbfe5a0ab40f86a24bbad83bba0391309131b1_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:59655061ef913aba1fef47291bc95ebd598812f4cf9dbd165023ae6e4cd2460a_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:cae46a1af7b4e0a13a66af872fd656c204518346ef98ae8c9d6f3294835d3ff7_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:971658bc181b91230bd0f0b276f85a23f805f08453cebe759b3ac37adca97cae_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:9f1f1898a1af86a86b754e43a5a3079a6d8e1fbfd3073080d35e6a8d218a00af_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:c5a08b7d120931634b936e68f443fbe4514856c54c862c6997d745610d4bf972_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:d88efca7559feab0c82f074424dd80a43119ecb4a7d23d70ee17209268b125cc_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:3856ceed1bf6b88c09795ca077d14a73ef4b2a4383a84055e8fe56185219b7d0_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:921b4cf740762622bbb48ffed32fa97e8bb4d835b892d6a5dfcba4369cae544f_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:b7ca78bf9690524383e4d68f06a0a48f79f9bd171c4d7ebf7ceba79fc239217f_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:c2a3ff3f39e40893d8e1205acffe05cfcfa89e3dd8407d4ca06600de4893f5b9_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:b4d6b30d562e1cacbb1ca461e8c14b95c0d42be1baf876599c446669f2584feb_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. To reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be beneficial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure.

🔗 References (8)