RHSA-2025:23206HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.3 security update

Published
December 15, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (4)

CVE-2024-45338 →CVE-2025-13888 →CVE-2025-49844 →CVE-2024-45337 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-13888 — openshift-gitops-operator: OpenShift GitOps: Namespace Admin Cluster Takeover via Privileged Jobs CVE-2025-49844 — Redis: Redis Lua Use-After-Free may lead to remote code execution

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:8c3785cd1c2aabe85c1f447a82583c56860f6a88ad108985338d334cd29e187d_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:a120d2036e7647b266f5cb1caa22f08a6e7c7241ab4073461fd61fdc51a43e4c_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:cf7438a5cf8a56eb937cf7a7e6fbd0430837b5e9376c4ad1c1ea44ae8c35c3a4_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:ebd9f980835a823bbf1e776a0460302fba6fc1c00410046293d5b3e3757ff966_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:090423a7278d01ebbf7ed048dea9c7e33dcaf36ab5fd37aeb8ebf9832a98ee35_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:b3de65128344dffd9b0c6007e0118bed2976a3273b272e96cdac6d0265bdb68d_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:f7c8a44e27576faeb89037a79b1e175a66d7ad895ecc001f224c45c59bcc9529_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:fbc0820ef3ea0ddc7aa0a32e8556847966b98bf5563aee25d9d5b9dba0563b56_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:8d8eea444b653ab2ba3b252fe996d7775d457cd09cfa384f0fa3a51fe4576a5c_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:9edc4f6b0da4723b4ae2e18846ce44596204ccd5413cd6af2b3da62c028962ff_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:a3fadba4ca091be88f26efb8d6fb4298e94c89c5473171277369d87972587df3_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:f602e146b76cd3c1f40d19f2b10cb9a9a09de8a58b637d054fe509c3d3c848f4_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:29ac3485b2753099dc2ce4bd9f0d433fd007eb80b19949e6084617d5e4c8401c_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:33b21324dcd8deaa69ca27e256c32269b9c8520c8f841a65369b99f40867fb39_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:6a51fa2984a09ab535a4a642e037dbe4d749b0c287001d73867f36af15fdedf6_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:ed4f5d2f4be89dacb91eb072fd06065d1c4a3bbe95a779f15910913a2c01b8bf_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:111d349469f89ce6d1d3678d26f195e2aabfc06d10c46095be671b0fd0c28e95_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:27a6b27b8fa043d8f7be96c526ef0d361bedda1957eae7a464549e7fa4f4d90c_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:2fa2d758167075121d90193a20c6133f6b956b97d60ff149c48139e382c5e240_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:b2886641771b90438b0a68d865a628b532fb22355693248c5689bb4de397e6f6_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:68c54254b55558f7a59a419757c3706c11c72b65126427c5d070472e8c49f445_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:90b53754882f44c06f1736dee31266e6d3b84a35b88d4211b4816d56b92453fa_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:c4a07e270cb2f8b9136be341923575c7c6a533010d2053f6fdbc7aec48e29bca_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:ef45471b5e81bfa5f3b61f2e6159ec863ad8de3af2faf78d6efa229d8ee7708d_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:5f18539d5ffc19d3525321bee95ea2da33de174c20debfb28e42bee1a8008df4_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:7f305f88b076e660cf4329f995cf6a6b12ef5ae325580004580d0c6f0ecf569e_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:9ae4f68d8ac57af106a20674dddbaaf7c273aab5b359d1a3cfa7c6e498d0615a_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:a4876418208983e14da1e0434ded22043e1880bf1bb5e60c0cea6295a772eac8_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:e1101b02df32a56a9aec80639372248b72963240dc86add446d0d07da65baca7_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. To reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be beneficial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure.

🔗 References (9)