RHSA-2025:8078HighCVSS 8.2

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3

Published
May 21, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (2)

CVE-2024-11831 →CVE-2024-48949 →

📋 Description

CVE-2024-11831 — npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript CVE-2024-48949 — elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

🎯 Affected products105

  • Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:4e9f8fbf829890e56a9104442d00baed6fd30681b11dfd1965e8927a32e2361f_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:83a0882de5e57695803e77af98927aa690b4b1e2388bba7622e5ad7886709ef9_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:c00d5f70cad8c6a1638cdfb9a13fac25d7116d078ccd31c7de8368e639a096b5_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8@sha256:cef7b67f7f9ff1c351661ac8ceef8cd00affb27b8d8bbc773e27a9f5745dedab_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:3b11a142e5018e047c185199f157089d47e86f470e9ada73d0c36cd84ae2f020_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:9db055e86c5f89c7803f1df321effd244baeb0b1b65e01456f273fc3d3050055_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:a3cb4e01a5bfdec1219ef2f8887891296d2a102a8b2861c2fa15e2ec8cc00aa4_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:bf0725451a5ea375fd3b24bfd45be0c90eeca09a4a16e5f32a1e29e6506babee_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:07890a6afd16b3b0587c9923ce9aceeb1095f9ac4b9700abfa3ad0499669c6ad_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:88f2cbf9fae62392766b73fbd2155e41df315e5febea92c9d2daa841e5840c9b_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:9d70141127924754b33d56d0e7ad0baae06dad4c5e61fac2512f21c547c44b0a_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:a50c0024c8176cf021498f2fc0a1913d64488858671bda51572f6bd6bac712e4_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:3c828b862bb69a1af4ce9c23036a115cffa330ecf5e321e73a7d8336ccfdaf49_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:48db9238b25ae5d5cb9b0900a36a91b7d0156d0ed94e1460acc4d9fb679c1273_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:b8ca210fcfb3e296117710ef56a7a9b1e933971887fc398d630bd9be9a2f797d_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:d015ac43304c1920917d2a36fffa1f62cb0c561ef9bf6304541022f71670a196_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:7c0151f712895dffe46170337feeb805967e6715315b07060531fb3b7d3d36ee_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:9519b6b85ea0a67b513839a4bf0be420a64caa8b34cb5e49913d364cac7d7ac5_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:e4ff758376a5573f38ecdcc8fabfe685712db9eeede3ad1ba611a4131f486cf9_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:e79b931a490129cf80b03372cb39aadaf4948a5ace22c7bf3474a00463aa5ce5_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:0b0b4f754296a53f6d040d0fb275134e1d3ff0dd9d22f3b5c3356aae6b5145e4_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:12c629eb3eecfeafcc7a29ba50f52c12479768224fee35334ddbb773e7ee136d_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:2f2e490a2a0e8c63b49cf56745ef45ff5209b341d609a2465fc4d057867687c2_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8@sha256:5e6416d434fbef692f96a88369b232c957606489f30dde446ae7011fbe81071b_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:56d3e381b80d8d8c5411d82c7e97e97a062ffbd3e10a9e71c350e3aef1469a3e_s390x as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:63cf32437a1e7c17176cd9107c7c8ecbee7fe70015b22b29874590cdfc3cc605_arm64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:8255b9bce95f7d0c463fc81f22f658d69466e961dd8dc12a83d736c024a6ee7f_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:dca68e144aae6acf0aa74805e5db1b73adb2612d8a60bd5e3a393c32509cabf4_ppc64le as a component of Red Hat OpenShift Pipelines 1.15
  • registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel8@sha256:563d16c97cd026840acdf80c1a67c70ef2ed13b062dad5b87b96da1f8d60ff3c_amd64 as a component of Red Hat OpenShift Pipelines 1.15
  • +75 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)