SB2025121637 - Multiple vulnerabilities in Red Hat OpenShift GitOps 1.17
Published: December 16, 2025 Updated: February 6, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2024-45338)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in several Parse functions. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2025-49844)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error. A remote user can use a specially crafted Lua script to manipulate the garbage collector and execute arbitrary code on the target system.
3) Improper authorization (CVE-ID: CVE-2024-45337)
The vulnerability allows a remote attacker to gain unauthorized access to the application.
The vulnerability exists due to improper authorization caused by improper usage of the ServerConfig.PublicKeyCallback callback. A remote attacker can bypass authorization in certain cases and gain access to the application.
4) Incorrect privilege assignment (CVE-ID: CVE-2025-13888)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to incorrect privilege assignment. A remote user can create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.
Remediation
Install update from vendor's website.