RHSA-2025:7753 - Security Advisory

Topic

Errata Advisory for Red Hat OpenShift GitOps 1.15.2 release

Description

Errata Advisory for Red Hat OpenShift GitOps 1.15.2 release

Security Fix(es):

• openshift-gitops-operator-container: Namespace Isolation Break [gitops-1.15](CVE-2024-13484)
• openshift-gitops-argocd-container: Go JOSE's Parsing Vulnerable to Denial of Service [gitops-1.15](CVE-2025-27144)
• openshift-gitops-argocd-rhel9-container: Go JOSE's Parsing Vulnerable to Denial of Service [gitops-1.15](CVE-2025-27144)
• openshift-gitops-dex-container: Go JOSE's Parsing Vulnerable to Denial of Service [gitops-1.15](CVE-2025-27144)
• openshift-gitops-operator-bundle-container: Go JOSE's Parsing Vulnerable to Denial of Service [gitops-1.15](CVE-2025-27144)
• openshift-gitops-container: Potential denial of service in golang.org/x/crypto [gitops-1.15](CVE-2025-22869)
• openshift-gitops-argo-rollouts-container: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS [gitops-1.15](CVE-2023-45288)
• openshift-gitops-argocd-container: Memory Exhaustion in Expr Parser with Unrestricted Input [gitops-1.15](CVE-2025-29786)
• openshift-gitops-argocd-rhel9-container: Memory Exhaustion in Expr Parser with Unrestricted Input [gitops-1.15](CVE-2025-29786)
• openshift-gitops-argocd-container: jwt-go allows excessive memory allocation during header parsing [gitops-1.15](CVE-2025-30204)
• openshift-gitops-argocd-rhel9-container: jwt-go allows excessive memory allocation during header parsing [gitops-1.15](CVE-2025-30204)
• openshift-gitops-operator-bundle-container: jwt-go allows excessive memory allocation during header parsing [gitops-1.15](CVE-2025-30204)
• openshift-gitops-argocd-container: Prototype Pollution in redoc [gitops-1.15](CVE-2024-57083)
• openshift-gitops-argocd-rhel9-container: Prototype Pollution in redoc [gitops-1.15](CVE-2024-57083)
• openshift-gitops-dex-container: Unexpected memory consumption during token parsing in golang.org/x/oauth2 [gitops-1.15](CVE-2025-22868)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift GitOps 1.15 for RHEL 9 x86_64
• Red Hat OpenShift GitOps 1.15 for RHEL 8 x86_64
• Red Hat OpenShift GitOps for IBM Power, little endian 1.15 for RHEL 8 ppc64le
• Red Hat OpenShift GitOps for IBM Z and LinuxONE 1.15 for RHEL 8 s390x
• Red Hat OpenShift GitOps for ARM 64 1.15 for RHEL 9 aarch64
• Red Hat OpenShift GitOps for ARM 64 1.15 for RHEL 8 aarch64

Fixes

• GITOPS-6150 - Argo CD reverts the manual changes made to the resource on cluster, when using annotated git tags
• GITOPS-6287 - Openshift GitOps server pod is crashing
• GITOPS-6625 - cherry pick [fix: handle annotated git tags correctly in repo server cache] to release-2.13 branch on upstream
• GITOPS-6664 - [1.15.x]Customers updating to 1.15.1 hit a "error setting app health" error
• GITOPS-6713 - fix: Check placement exists before length check

CVEs

• CVE-2023-45288
• CVE-2024-8176
• CVE-2024-11187
• CVE-2024-12087
• CVE-2024-12088
• CVE-2024-12133
• CVE-2024-12243
• CVE-2024-12747
• CVE-2024-13484
• CVE-2024-55549
• CVE-2024-56171
• CVE-2024-57083
• CVE-2025-0395
• CVE-2025-1244
• CVE-2025-22868
• CVE-2025-22869
• CVE-2025-24528
• CVE-2025-24855
• CVE-2025-24928
• CVE-2025-27144
• CVE-2025-29786
• CVE-2025-30204

References

• https://access.redhat.com/security/updates/classification/#important