RHSA-2025:23203 - Security Advisory

Topic

Important: Red Hat OpenShift GitOps v1.18.2 security update

Description

An update is now available for Red Hat OpenShift GitOps.
Bug Fix(es) and Enhancement(s):

• GITOPS-7608 (Redis HA pods are taking longer than expected to come up)
• GITOPS-7789 (Version override in ArgoCD CR causes operator to use upstream images)
• GITOPS-7798 (Progress Sync Unknown in UI (cherry-pick #24202 for 3.1))
• GITOPS-7844 (GitOpsService controller creates default ArgoCD with v1alpha1 api version)
• GITOPS-8019 (CVE-2025-49844 - Vulnerability with Redis)
• GITOPS-8033 (openshift-gitops-redis-ha-haproxy deployment fails to rollout with 3 worker nodes)
• GITOPS-8067 (1.18.z - Hide Dev Preview Badge in GitOps Operator's Operand tabs)
• GITOPS-8142 (CVE-2024-45337 reported by RHACS for OpenShift GitOps Operator v1.18.1 (ArgoCD-based) due to outdated git-lfs binary, dependency update required to remove false positive.)
• GITOPS-8152 (ArgoCD CR Reconciliation fails if spec.applicationSet.webhookServer.route.enabled is set to true)
• *Post-Upgrade Action Required: Audit GitOps Operator Roles**

Following this upgrade, we strongly recommend you run the provided audit script to review namespace-scoped access.

• The script identifies Roles/RoleBindings that grant cross-namespace access for the GitOps operator's features (created via .spec.sourceNamespaces).
• Run it to verify and confirm that only the intended namespaces have cross-namespace access to deploy applications.

For more details, refer to :

• https://github.com/redhat-developer/gitops-operator/tree/master/scripts/audit-namespace-roles

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Fixes

• https://issues.redhat.com/browse/GITOPS-7608
• https://issues.redhat.com/browse/GITOPS-7789
• https://issues.redhat.com/browse/GITOPS-7798
• https://issues.redhat.com/browse/GITOPS-7844
• https://issues.redhat.com/browse/GITOPS-8019
• https://issues.redhat.com/browse/GITOPS-8033
• https://issues.redhat.com/browse/GITOPS-8142
• https://issues.redhat.com/browse/GITOPS-8152

CVEs

• CVE-2024-45337
• CVE-2025-13888
• CVE-2025-49844

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.18/
• https://github.com/redhat-developer/gitops-operator/tree/master/scripts/audit-namespace-roles