Red Hat Security Advisory

RHSA-2025:23203

Red Hat OpenShift GitOps v1.18.2 security update

Released 2025-12-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator

Fixes 3 records

TI-2025-31759 CVE-2025-49844

Redis Lua Use-After-Free may lead to remote code execution

HIGH 84

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.82638 Published 2025-10-03 Fixed in 8.2.2 CWE-416

TI-2024-30407 CVE-2024-45337 · GHSA-v778-237x-gjrc

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

MEDIUM 53

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03181 Published 2024-12-11 Partial fix · 0.31.0 CWE-285

TI-2025-12691 CVE-2025-13888 · GHSA-pcqx-8qww-7f4v

Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs

MEDIUM 42

A flaw was found in OpenShift GitOps.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00691 Published 2025-12-15 Fixed in 1.16.2, sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa +3 CWE-266