RHSA-2025:23206 - Security Advisory

Topic

Important: Red Hat OpenShift GitOps v1.17.3 security update

Description

An update is now available for Red Hat OpenShift GitOps.
Bug Fix(es) and Enhancement(s):

• GITOPS-8116 (CVE-2024-45338 openshift-gitops-dex-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html [gitops-1.17])
• GITOPS-7608 (Redis HA pods are taking longer than expected to come up)
• GITOPS-7789 (Version override in ArgoCD CR causes operator to use upstream images)
• GITOPS-7844 (GitOpsService controller creates default ArgoCD with v1alpha1 api version)
• GITOPS-8019 (CVE-2025-49844 - Vulnerability with Redis)
• GITOPS-8033 (openshift-gitops-redis-ha-haproxy deployment fails to rollout with 3 worker nodes)
• GITOPS-8142 (CVE-2024-45337 reported by RHACS for OpenShift GitOps Operator v1.18.1 (ArgoCD-based) due to outdated git-lfs binary, dependency update required to remove false positive.)
• GITOPS-8152 (ArgoCD CR Reconciliation fails if spec.applicationSet.webhookServer.route.enabled is set to true)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Fixes

• https://issues.redhat.com/browse/GITOPS-7608
• https://issues.redhat.com/browse/GITOPS-7789
• https://issues.redhat.com/browse/GITOPS-7844
• https://issues.redhat.com/browse/GITOPS-8019
• https://issues.redhat.com/browse/GITOPS-8033
• https://issues.redhat.com/browse/GITOPS-8142
• https://issues.redhat.com/browse/GITOPS-8152

CVEs

• CVE-2024-45337
• CVE-2024-45338
• CVE-2025-13888
• CVE-2025-49844

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.17/
• https://github.com/redhat-developer/gitops-operator/tree/master/scripts/audit-namespace-roles