RHSA-2025:8233HighCVSS 8.2

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.18.1

Published
May 27, 2025
Last Modified
September 4, 2026

🔗 CVE IDs covered (3)

CVE-2024-11831 →CVE-2024-21536 →CVE-2024-48949 →

📋 Description

CVE-2024-11831 — npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript CVE-2024-21536 — http-proxy-middleware: Denial of Service CVE-2024-48949 — elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

🎯 Affected products113

  • Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:3cb31583d9c4c8624f90bda873a6d05ffdac29ca5859e94db32f3e4c73eff748_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:406a16441e1cc53a0eec45b4b5b622f918ea08f8c809d2c435c8516627a03599_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:7736c9d964a6aa7dffee03a5fcdbe858b68b90f17c5ac8dd1e762b9249fa1834_s390x as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:d8f71d2e62650afad24e79db08e485b22a59aede5b9884d34f2b6bca90ab265e_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:2a341455b44a815ff0ff54c4f31e40085ebacb55ad912d18f711cd8e0f97d659_s390x as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:864a0ebb9468872d6063514830a116cfa3b0bec14f28f9a7601801ee49c7af06_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:8b44ee10cba6dfaad0d8128d2e6162088bc9462772244675a5577c0311a443d8_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:ab7ab07f70652051c28efcdcbd2809696e0ba5af9d5da15132d8b8a475d01d00_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:7a71e590bb448f9f6c9f1e8f8ad0396770cc015e22358d5f7b022f79f2ff01e2_s390x as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:84e10d312676155854040d690a112c858a97f4a6d77b7cee9aafee3e406e2dd5_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:9be5c06da958a90ed6b4be9bb20e01836473d1ba23f1b5fed58f94e577900fde_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:bc7602c4523fa8c1906e6857e61957d2d73f9e62536934da97dc5000a3e5f8eb_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:23b260fc5bc279c77bea438090212417596a1abc08a0ef01c38d832e4fee0422_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:4508afe67eb7af227b628d30e8faa59ecb8c4ad74a3c03a6d43c7fefabcb1ece_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:7b0d32cd44e5fb193b8872d11953a85d948f9843fe391ef73e3df761ae6c803e_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:c18db2f00e436cca251416db2408711c05d2ddd01ac7513e8c8601107f9acd3d_s390x as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:3e29d611c971cf0496d9094da0c292548d7625e38148217366803d55492b6336_s390x as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:94694742020a5c4c14b3098228d0eeab42f4d7720e9fdb4e5f46500d9f90511e_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:b915203b152c8860038e17522117672b1f4a9b9f992ff5e8b34c7c1119debac5_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:f49742e8d222a9a3f34025bd04e498afb28acf9199ad4da9790a9eac4f6c429c_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:0bd152bf0915ca9bcabe9b4ec25c04e9534d04bf4705d9010279380f177217e5_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:5b65f197b3f0c985bf04c2308f71ae940f7f4547a3236c6eba57a7f3271ca9cf_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:6868e18e49348f869eb0d78e528e2b36be2dfe896b4fc5bbab0225b4f372e931_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:ecda1dfbf2343475d5f8502dfb4964430ac5c368c67c78bd5229b74787c25e91_s390x as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:0b70e46f72fb4badf1fd9e6149286518d015a45c972fdad6775328d11ce6d666_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:af7077e87c7436aa2351a8b66c17ad6c996456edced0761240133f535b452cdb_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:db4ba18fcdbd67c343bb9ca9ceaa619fdaa4dd50979095b9f7697650ee43fced_s390x as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel9@sha256:fb1ebecec74c135e58837085c569cf1d3908beeaff30c5380ffd5edda9370408_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:6be3a3ce56efddd606c949b056e4caef71603e0df35db5a4caa96299915e6264_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0
  • +83 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat Product Security does not have any mitigation recommendations at this time.

🔗 References (7)