RHSA-2026:3710HighCVSS 8.7

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3

Published
March 4, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (11)

CVE-2025-66031 →CVE-2024-37890 →CVE-2025-6545 →CVE-2025-9287 →CVE-2025-12816 →CVE-2025-13465 →CVE-2025-66506 →CVE-2025-66564 →CVE-2025-6547 →CVE-2025-9288 →CVE-2025-15284 →

📋 Description

CVE-2024-37890 — nodejs-ws: denial of service when handling a request with many HTTP headers CVE-2025-6545 — pbkdf2: pbkdf2 silently returns predictable key material CVE-2025-6547 — pbkdf2: pbkdf2 silently returns static keys CVE-2025-9287 — cipher-base: Cipher-base hash manipulation CVE-2025-9288 — sha.js: Missing type checks leading to hash rewind and passing on crafted data CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-66031 — node-forge: node-forge ASN.1 Unbounded Recursion CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2025-66564 — github.com/sigstore/timestamp-authority: Sigstore Timestamp Authority: Denial of Service via excessive OID or Content-Type header parsing

🎯 Affected products105

  • Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:0cb744cb7946d857a2cffec641fcbc994e77ddc8d4a5b14c17a28621f4a0a4a9_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:416c99f02abb6274fc87b2599e96b90e74e7a94c28806629c2b98fb2dc7e2afc_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:5c78dfe2380653f0167358565c8b7cab1010321a4eda27ec931715805ab2c256_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:d71dc72648f45660ae1fd98acac0f1876540cac853f5c097ab85c3a5f2c2084f_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:494857108f0b09c8b8985062cc11b9879d126b207fcd72f6abb64ded3d8d1793_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:abca24c41cb24749e70a90aac93354d1924785e3eaf92a55b6906690861bac49_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:b7b03dd023aafe65290969336bcf9e0b7a241c3510dcb3d26519581ba4eed719_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:d52e4a16b2908e99f1e69a1e2ee9233a231fd28c70916ed06c9cd8560478340c_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:35c7d22ab878030711c1ec9d340f25f78257ca3eabdcb5db23db90e80d55e8f1_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:5345cdb7e11186fda1577345f0e426946a5ee9e6bbe6486845511f03114dbe52_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:71d7e93eb9e845a429a7e68801ce7675ffdeebb730c236a8b6c3d59767d8e5d8_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:b33b33412464a6d0bf510e6dd2dc7df8b4ced9a5c08a14d8522db6c8457d1a36_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:9209e159bb11236b49511ed3a59c7f687d06a9f82a02497a637d765cc14ea0c3_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:b2c21a004712bd198698ea75793e57abbe1665e17479e34d0b5e8c81d60b967d_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:b894d94d3e18dc2f4f71f4e791e25da158397264b49ac82f4780ac3322e66200_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:f532249811710dde78cab85e31f99bfebb5ee161167f8116ea00297ac343eefd_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:001e28b882e81e4d424b2e1a39933211f15e68048406a6432e6ec59e4b96cc2c_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:03dc5eb942a8fb202d8d6492764d5d27dcc326b556bb068070c10b00a3a9d277_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:0e59fd179abc02c54784b3293bc3d21087bd0ec135c691c5523879149da33a5a_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:898085897ff200fdba4d6c14b59548c7fe53164a8c2649e2263a69116737edbf_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:3479cbadb4aa7bab5cc56115d7efe4e406d60010e28561857804926c3fbac9cc_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:6067cedcfde517cc751e14030c620126ea6facf50a4ff16374ca8ebe7bfcbe8b_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:a77292658b1ef1e2922f2b7c904ff73c8911bb84f130953897c3a66aec8560da_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:c8aaf02aede730dacca2eed8bb32044f39b74d3ee3fd619a0fa2af864d874fa6_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:1066cf4185e3cd917c05e6d6759fb0a69428c4b43398df10dff8abe523761c09_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:525bbd7fe14ba88b4d9be13c5857e477e3a8daac1185a146707ebb8ef8e81acd_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:dbb678695a4bd07c27a14fec9b70359929bf0d4d33d9ce2d70d1b5157e5026c1_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:fbddec04429c15c833b7631fe3d7c783d33520f30f6d5c8aef2e66b7634873b8_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel8@sha256:0a12cf22aa798dbc3661f7e83aa9c280fe394de5b0ecc6ed7c93be1df539fce9_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • +75 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: The issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. The issue can be mitigated also by seting server.maxHeadersCount to 0. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.

🔗 References (15)