RHSA-2026:3718HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4

Published
March 4, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (5)

CVE-2025-22869 →CVE-2025-27144 →CVE-2025-30204 →CVE-2024-24790 →CVE-2025-22868 →

📋 Description

CVE-2024-24790 — golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-22869 — golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products9

  • Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:0b83b8f1ca2060c8ff2fa92b84c93b278b21300904e268b62cbb37c4591872b8_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:c179dbd8fe4a59f4a0db841f71273fc2b25f039c1f394fc28d8fe9ae233457bb_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:c9ed680f83130eac3e4d0567a91b3baf98de55a81eee8635ac2cc6369743bb5a_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:d968fd24bce22668f30a07456f7dd60452f33b10931ac8bba170d87bc69486a0_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:1cb101c47928262aaffca1666428c45db5c44b4e43b7cb9b77f6339ffe23c6e9_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:26cfa3764e6cbfefda7aa9c2c66aaf89ca4ec3443f6f26c8a060a01f44c5b62d_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:6c84b926c8c564decc5766bd0353ce5bb20ee60efb7861d2e9ce1d0180d2c098_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:eea4eb420ed55b0b96728cbf0f9ae56578f86e699fd5071da7df5b1b5a8b842c_arm64 as a component of Red Hat OpenShift Pipelines 1.15

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: This flaw can be mitigated when using the client only connecting to trusted servers. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (9)