RHSA-2025:22058 - Security Advisory

Topic

The Tech Preview release of the RHTAS Policy Controller Operator.
For more details see [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1).

Description

The RHTAS Policy Controller Operator can be used with OpenShift Container Platform 4.15, 4.16, 4.17, 4.18, and 4.19

Solution

The RHTAS Policy Controller Operator is Helm-based operator for deploying and managing instances of the Sigstore Policy Controller on OpenShift. It is a self-managed on-premise deployment of the [Policy Controller Helm Charts](https://github.com/sigstore/helm-charts/tree/main/charts/policy-controller). Platform Engineers, Software Developers and Security Professionals may use the RHTAS Policy Controller Operator to enforce policies on OCP clusters by using supply-chain metadata.
For details on using the RHTAS Policy Controller Operator, refer to [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer).

Fixes

CVEs

• CVE-2025-11621
• CVE-2025-12044

References

• https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer
• https://access.redhat.com/security/updates/classification/