RHSA-2025:8274HighCVSS 8.2

Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.14.4 security update

Published
May 28, 2025
Last Modified
August 26, 2026

🔗 CVE IDs covered (7)

CVE-2025-30204 →CVE-2025-47933 →CVE-2023-45288 →CVE-2024-13484 →CVE-2024-57083 →CVE-2025-22868 →CVE-2025-22869 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2024-13484 — openshift-gitops-operator-container: Namespace Isolation Break CVE-2024-57083 — redoc: Prototype Pollution in redoc CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-47933 — argocd: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS)

🎯 Affected products36

  • Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:23a8aac6d2e009bbba4b0bd7beec63306f0c1509f34d2dd8ab8a611011dc17dd_s390x as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:d72734b90db1ce7201a96c524ac571c87a49da09ff4d318f68ae6852c6d16b76_arm64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:dbdb2e380a47e55c12c4c4fea9fc4b69f9073ef00138dd82923dc095250d4db6_ppc64le as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:fdb7dba204200801073ff293ad3842c6ae48b6decafae292729ad7d571e90f19_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argocd-rhel8@sha256:30d63e8254a436279fc5e11c5bf7b62d85502acc221d4207fd70a15e54a7ee16_s390x as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argocd-rhel8@sha256:7c537c7cf6a0432646b7ab05ee73e0977f5f3b7b0fd3d6be37c02f9396a1d737_ppc64le as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argocd-rhel8@sha256:cb5b95895261589a9845628f6ba2f0d8bea6bde9908ed8d49c3e4ae24d447f50_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argocd-rhel8@sha256:d238690e3827286b7aba7f7d259ec0aaae1ae3fe923c56b00c742ec8737a7c8c_arm64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argocd-rhel9@sha256:9e0f1ba8a30ad561367651c67f641fd0053f45d17bb175f9f6889f8461bae790_arm64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/argocd-rhel9@sha256:b7c3bb5d3cbde94a34aa0244bb0362e7069a3de221dec6b8b820c0d235bd76fe_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/console-plugin-rhel8@sha256:0512fba38410f128d3137fa397281b5ca95b76943dd51fcf78a7feacbb16d96b_s390x as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/console-plugin-rhel8@sha256:49d66633f974c5ce83a09bca0a69538271b4991f1e7df4b35e2d7fb2540188f7_arm64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/console-plugin-rhel8@sha256:8dc71e6ebd38cb2e54de2cc2c13717e170944598b206e332d799acb5bd411a40_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/console-plugin-rhel8@sha256:c3c850aa2526b48853e27a808b3565dcfd133770229be259b60fb9286f8f5d2e_ppc64le as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/dex-rhel8@sha256:455f5ae73a9f061ee99f914544abbfef7a5b902179fdaf956802edcee20d767a_arm64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/dex-rhel8@sha256:bd801415cb506c52d03a390323c098c7fa8f99af1895301708d1a0a56f72b215_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/dex-rhel8@sha256:e7f8db64e7c7a2ae31caf2f54c60debc803acacc7f0df18e49c246f3f878557e_s390x as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/dex-rhel8@sha256:f32c097916c50ab0718ec75c1bf6ea12abc99b1b29e4cb3ece122fa4112e6a42_ppc64le as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-operator-bundle@sha256:773592dfb9964970f444871a8812e8b74db3f205faaa0bf148defa1a2b87b649_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8-operator@sha256:57388b8ed2c018728f7efed7d355fa1ac066d19c224a27a7517a2fba01c5d3f6_s390x as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8-operator@sha256:8181401cb43af84059707ab096fa7f0599a251aadc4f7d53bb38098b5e7dd752_arm64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8-operator@sha256:97603cb305c6ff71a01aef4c494ca4e4b013bb1f55e4a98c99734d57fb03f4f8_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8-operator@sha256:a3c3733bb827d469b5f51b9804a1515a13f58dd21e9f436bbdd0df280bb49f93_ppc64le as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8@sha256:8989ea6a8e7cb8a7ef64635fcf28c9b800c9287411071444f8fb358df832fe38_ppc64le as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8@sha256:e7e7dba53756f1053ca385b6c279889c9c87bf05adc604b77619fec12c582f99_arm64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8@sha256:e8b3e42c2ca79b6665920f9a739461f94937e511c2e7ccf60da338460084de0f_s390x as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/gitops-rhel8@sha256:fa82571fbf077de163d8d56d9d587971f5179740e9455e9e7bd6bc62b0330ba3_amd64 as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/kam-delivery-rhel8@sha256:2e641073b54b27f405def00c4b8731cbf9cdffe2ed8f89c9c29782c18fb55b67_s390x as a component of Red Hat OpenShift GitOps 1.14
  • openshift-gitops-1/kam-delivery-rhel8@sha256:78c9599b4298cb6dcb59c871c52bd4b0e135fc03c723fa1d02ce584193ac14c7_ppc64le as a component of Red Hat OpenShift GitOps 1.14
  • +6 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (4)