RHSA-2025:1888HighCVSS 8.1

Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.15.1 security update

Published
February 26, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (3)

CVE-2025-21613 →CVE-2025-21614 →CVE-2025-23216 →

📋 Description

CVE-2025-21613 — go-git: argument injection via the URL field CVE-2025-21614 — go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies CVE-2025-23216 — argocd: Argo CD does not scrub secret values from patch errors

🎯 Affected products36

  • Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:54abda352f19fd193a5890445d5c8d135f0c4044f4c62482d47f644f1a09000b_ppc64le as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:70fc9ea0f6d0951f5946a4dbf89070e6323e24cb9977630be065595d6e624fa2_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:a4e52634ee81ad62dff4b7d812c36a80ce847a652a84c60152dfc297692c488c_s390x as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argo-rollouts-rhel8@sha256:d7f6f0ef41c85d522642ffefa773b56891ddb34d19c8a67246f60a2331009643_arm64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-extensions-rhel8@sha256:70d3c68a3941408f72033ec39c13a9440eb1f03ab6ae37d46b90a7c209a4b0bf_s390x as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-extensions-rhel8@sha256:aaedaf766d9470b27d6fbb010eac810f46784b8d074ac532654b294f706a26fb_arm64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-extensions-rhel8@sha256:ba3902b3e59e30c01ca8145bb16f2b0b51d419de59ef9e2e013cee4c98a23092_ppc64le as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-extensions-rhel8@sha256:eedef69c1b7496dc520b53e6e1ff7da33065c0086da79e48d794684446482ef3_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-rhel8@sha256:10ba43a5679d2afd61b5137abed33619d160679e9632b9d8de98c85c547d6014_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-rhel8@sha256:6e37e7ab0a6e55f38abef2f1cc1713570e200bac197aa5d4b8d3162a1f9660e9_ppc64le as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-rhel8@sha256:b9ceaf8a22e78df65ffa95fba4366e5765b851683f73589e8d85ffd38cbaa839_s390x as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-rhel8@sha256:ecdb61f00e9ea64cfb5ed37dcd060d76043bc35b9db90a395b247f36de88ca0b_arm64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-rhel9@sha256:c9d2d89362ef62cfa399982ae562951f563c64b4eab91fa2afd46eeca12cd5ca_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/argocd-rhel9@sha256:da7aad32b7efbb522fbb0a1401b990ec62333d13158f5a6facc7cfc586db846b_arm64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/console-plugin-rhel8@sha256:624cfcabed8a404f04cbca3b7b0f6d7e63ebff624462f2c018eabe34c62645a8_ppc64le as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/console-plugin-rhel8@sha256:b02c241ec40f32d9fb31cb733a0d6f86163fc1588e043cabe814380ad7506450_s390x as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/console-plugin-rhel8@sha256:bc671a2a360cfc25349a52014e8cdf2e458858932b0165819b30811eccba5df4_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/console-plugin-rhel8@sha256:e4deb2da29aa4a5f76e49553143892b23fea420eb6e5459607c399a90fcba68d_arm64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/dex-rhel8@sha256:032f1df977d734277e6233215a21391bd5de169038e3f8a36ad7915308fb40c8_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/dex-rhel8@sha256:300308a16440280f490b15d91209b70b6125a3a3ce3ad644b2701a521e04d1c8_s390x as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/dex-rhel8@sha256:5d20db826bd4be6e9cda1cdddfe9b5029ea176574c5968ce8336016624fae94d_ppc64le as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/dex-rhel8@sha256:a45731d6088b941baf4888683fd93a8b3eb40ad1944d1fea3bbfe74614de5303_arm64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/gitops-operator-bundle@sha256:8a0cde220937294ed559ee9dcbcdc840956270fdc66e917a0fe5f5971cf18f4e_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/gitops-rhel8-operator@sha256:0186a1987434299a9a88628c2175d9b41b4e04b7b21763b3299ba05ccbc7f1fb_s390x as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/gitops-rhel8-operator@sha256:6668b79c2823c75293fd6b207fa086fcf58c54f380faecccf0057cbe354b67ac_ppc64le as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/gitops-rhel8-operator@sha256:8da84540d819efcc3e4dc61b343b3c300e4983ce89b07b43e724ceca648d3f0b_arm64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/gitops-rhel8-operator@sha256:fbfd9db0d70abb2ea55454c18c477d842af2511b3c0021b4ee9cef0dbf6cbab4_amd64 as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/gitops-rhel8@sha256:3bb7c771c4df60f54636d2c5881650f0c6568fd6aa0ad7612ced26602f1daf14_s390x as a component of Red Hat OpenShift GitOps 1.15
  • openshift-gitops-1/gitops-rhel8@sha256:7e484f65fb5ee60ac88442b86b1c0b9b7445d0bf4e076adc488eea8f478ca544_ppc64le as a component of Red Hat OpenShift GitOps 1.15
  • +6 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)