RHSA-2026:3825HighCVSS 8.7

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3

Published
March 5, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (5)

CVE-2025-12816 →CVE-2025-13465 →CVE-2025-15284 →CVE-2025-66506 →CVE-2025-66564 →

📋 Description

CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2025-66564 — github.com/sigstore/timestamp-authority: Sigstore Timestamp Authority: Denial of Service via excessive OID or Content-Type header parsing

🎯 Affected products117

  • Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:17d540bfc2f5e4f3eb11b25b95dd7860ab1cfccce5814deb301fea08d95072dc_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:716f58c27ecb2a7885406bc866a3c2bb850396f770a556ef1bdaeccedfd24089_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:9ebb96ce55329bcc5f40a92be685329d7ec00bfff00bd5a3605102eb8d6ed719_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:c13e60b885afff7a2ee13fac8de563f4886e762406ee2976d5b23ea0ef656078_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:1ee6048f584257edcbc764ae87f6375e6ce2d25caf3cc8f98fed981e197816bd_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:6a0d1f472283c686e438dbfbeec826db9d7d95f45f92842c4073f70704860d2f_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:bbb93e9ce23fd650f5b19df958390c951c38b72de02c5fec9cfbb3b801e8312f_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:ef571581dc01c754dce5ca1dbd360fe86800c14853ce3f535a51d0f438467597_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:120d93e1cf2a96bfa9d7745b88377651055ebe5595f68b7b4a4bb26f633e8611_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:43efa5a676666dd4ae039ad5518eaf636f5baf8d688d9a4b475822c32ad1ddfb_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:7b0f572c22640568015fbcf42e9e242b2a640b70eb7bec97f00ee6967d0f598f_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:a01a2a1e02cffad381ecacab7bf6456ed9a0d1ad589cd0935ec5a4748e341fbe_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:27f3be442cf1d9f640657fb6d7cea6b133652226f9a80c3442df226b3cb3c2dc_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:2dd2182f98cb7beb6e8ef7d7fcfe13705501a11d425b99667afcbbfa52fd252a_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:72632d760862fdcfa54a910846b14f652dac23b185f7496c4c43097d537cc2d2_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:8559603458387b13ca544bf7a499fdaad82d18145b612e4e220e53480960dda0_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:98f5998cc667e71dbb51d133d39ae78156ccafa8bf171bd666edfac8de17ccba_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:b6fb02867ebc3be24c68dd24c9178ed17a655a20aa19d477954aae0896c53213_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:d7a11116dca914c661bbe20ecffe56afe6011fae809845859a4ffa2884e4f7db_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:fbb162c6620a1ac010cdd353682b30c6adebaf9a0064d6e3430555f7310c704c_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:5949d16546a241366ea103f003c733c875c4616794ba7cca42aebb7c585908ba_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:84469780cc76298499046e7a696b100a0393be411dc14fd8a3878fcedd86220e_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:a0389d20f0c4c08c0e5b6f0a6edd8216658e3957e1e7476c21129b7a36ed2a8d_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:d1a689ab23343c9fcfa24bf0ab56001971c0ab35a2505d8fa877346326bd8387_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:35412516c9d8d4ddb93f57bb59da160aa6abb11581a1a5df793fcbb8197f2e4f_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:bf6075f65fa2cb59af1c5cf9374c8958361c6c41318ae157abfa46a6d6e4d5b2_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:d3c24212665bd368c38a2b913b4bf9d8f5eb294ff269c0d5f23ac1c7f4bd6829_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:f3c6e7200e2834f4ed697bcaf8fc01a81bd88ae858d9a3c2b0efc36356ea4d91_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:7c36902406c9dc7a91897ea5fe36ba4e6ee9f6435094016fc21e31c057ba3dd7_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • +87 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.

🔗 References (9)