RHSA-2025:23207HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.16.5 security update

Published
December 15, 2025
Last Modified
August 19, 2026

🔗 CVE IDs covered (4)

CVE-2024-45337 →CVE-2024-45338 →CVE-2025-13888 →CVE-2025-49844 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2025-13888 — openshift-gitops-operator: OpenShift GitOps: Namespace Admin Cluster Takeover via Privileged Jobs CVE-2025-49844 — Redis: Redis Lua Use-After-Free may lead to remote code execution

🎯 Affected products38

  • Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:1b6aa315db581860193221a3f9c6fc41aee27e565be3b35d3bcfdf96b78aa9a1_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:9330fc60983057b6e4d5982a9d26f75edd19f60a27e51d399d432904fd6fabeb_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:9612285bdfdef053b85e20ae1f051fa920e54dab0fb2fe2eb07361a9b4a11b5b_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:d22dd4dd09ac5762db0e1640b0f4e095d9d7d8ab2a4a19a6387b1c677cc299bb_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:22d449937c066aea055b8591723934174748907161e4ff9f9086b59c5e95bf4f_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:5083f82c8c279384a9b1ffb03295da165d5b2e7c12538f5792b094830d8628bc_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:b560d638da1fd627ffe238a770d2b0a382f9947b429a02c22a39cfec7a9a14bd_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:ca1bb876d3e7b3dfede5b542a7c6a8bdece5555cc872f97d7e7a31823dad2fd5_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:0c5deccc37d4904c3d9e2395f8633588ab9ea2516f2b64809ff27eae06c0a4cb_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:128bc4204874b52f3d92a363224cf111b9d3905402526fe3cc267a52679bff2d_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:79b152b79000b6a9673f62bdaf0bf7ddd9175483cc8e3732417738569d9dcba3_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:be490bdfd6f793e7298e13792ee230cf6f061a67727aac6a0a6f298e02d106ce_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:529989e5fb64e6451ae21dd10f293e182ae52a3f938abe6e8082cf415cb0fb35_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:603bef1d5ab79b33458edc81bf06d32dd5be50df06eab25a0a1973c9083d7553_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:60be065c239e044ae5f9ac38a20d5d76e9f1912c2fa2bd84f7f0d0697a1e6cda_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:990d911c2141f78e8f2bae55f7de8b400d0e02dec1ea761d2befe24954debe88_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:01a290257f7a67491567952e14fe172486de00dec8bf7c963482bea6d4b3f9c7_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:206ef103465edbeef20de28b0c936eb1aa8403100f5ee58984964d614d099ea6_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:b4fac7c2dbc1139f070ab594e35bd2f424b81a4fa025754d1b3a7a4864c3a6c5_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:f4c13bc089a23eb0ce2057a9bc7f6ae7ea626b9ef27a568410f2e94fe27d6c07_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:28291a0151e5c5acc71c0da1dcf6d0476280bb12c81483c8c5f09929844ba0eb_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:86b9fb43226ae1b8db105c67f882388aaf4f6df816e3d90e5be1de234b48ad4d_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:d30ca5a1264146a12fe1f86f669272585a8976cbe2facba5c75fe1bf5ad46d26_s390x as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:f0c88a955a27b9939c7be9304ba56ea794cf08c4c2e9637eb7f06fb59055d416_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:1e7fb9262023798711dc58fecf9c57c2fbd260a7f942eef2a9fd2822dbfb0b74_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:52b550b043480277626e591ec85b832e91f69b5f91dd72fc8823788635f0eb11_arm64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:bcc192e3e9ff8dfd15bd311fdeda919653721e85338c96d5ad29fa6f1e4e3365_amd64 as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa_ppc64le as a component of Red Hat OpenShift GitOps 1.16
  • registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:d6102d2d2c0f46d8ceb81d7d85dba857283a6bca3828a99ccaef9feec7c1478a_s390x as a component of Red Hat OpenShift GitOps 1.16
  • +8 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. To reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be beneficial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure.

🔗 References (9)