VDB
RHSA-2025%3A17730
RHSA-2025%3A17730
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in Go's crypto/x509 package. This vulnerability allows improper certificate validation, bypassing policy constraints via using ExtKeyUsageAny in VerifyOptions.KeyUsages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:78dc89a4a9dfb8dcf93224fd9a3caa63ea1551f8da73a88aebb284123d4a2962_amd64 as a component of Red Hat OpenShift GitOps 1.16 | *, registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:78dc89a4a9dfb8dcf93224fd9a3caa63ea1551f8da73a88aebb284123d4a2962_amd64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:bc2ef6df807856991b716adea85d114c5f61a6ea02d1d3dddc86ddd61bacab76_ppc64le as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:989eefed937fc36a100303b24ae8fd4d1a88599a3cd0160cfac77180cc188a3b_ppc64le as a component of Red Hat OpenShift GitOps 1.16 | *, registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:989eefed937fc36a100303b24ae8fd4d1a88599a3cd0160cfac77180cc188a3b_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:190f9d93d0383e9d67079af14eacc7d960895883106d58819a2dd928d07df227_amd64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:0b76c3b83e7ffa1d650fdca227fa18a31a08339828160683ae7ff5a7a0bc6760_amd64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:400f6dc94a40d30e9bf08a6bbbdb69d03bac59f84c4d66620fa7d99b4b5a96f5_s390x as a component of Red Hat OpenShift GitOps 1.16 | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:400f6dc94a40d30e9bf08a6bbbdb69d03bac59f84c4d66620fa7d99b4b5a96f5_s390x, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:4dff7f7534e02fcc989f8c58646acf0a8de6eb950514a9eaebe0d4db7f799bb8_amd64 as a component of Red Hat OpenShift GitOps 1.16 | *, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:4dff7f7534e02fcc989f8c58646acf0a8de6eb950514a9eaebe0d4db7f799bb8_amd64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:6eb5d4b468ebf1732f466caebba617c30fb406623274a3acf7511805121e1eff_amd64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel8@sha256:8deb789cb88a48e8f887d5b33858a7d11e5d9d240290ee48bd7d4f32243dd38f_ppc64le as a component of Red Hat OpenShift GitOps 1.16 | *, registry.redhat.io/openshift-gitops-1/gitops-rhel8@sha256:8deb789cb88a48e8f887d5b33858a7d11e5d9d240290ee48bd7d4f32243dd38f_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:24d8c9b3d5e2302d86a6522bb8997cdf203a1121825a1a84834a58c972561334_ppc64le as a component of Red Hat OpenShift GitOps 1.16 | *, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:24d8c9b3d5e2302d86a6522bb8997cdf203a1121825a1a84834a58c972561334_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:645d19854b1ce41c0d260de0b210749453269f7418059be41c854f2e9bbf000c_arm64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:3caf15f8693245181eb1dc3adbf177c3be3095701b4fbb9ab64ec96af345855f_arm64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:af6a17b989475611cccb8dde3fc4b04c07d83c808a9e36537e04fc220357836c_arm64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:89b76d9ac08f2d7852e484f5cd3ba7c2aee0f9ff3444eb8a9344474125220042_ppc64le as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:bdd0a289775ce41a8b495e02626f2e84b39f27d8eab8e351faf13bd46c8bb843_s390x as a component of Red Hat OpenShift GitOps 1.16 | registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:bdd0a289775ce41a8b495e02626f2e84b39f27d8eab8e351faf13bd46c8bb843_s390x, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel8@sha256:2f35704b4a52925cbe845743de00c271ac07accd5a59c2d215b2b80491f72c0b_ppc64le as a component of Red Hat OpenShift GitOps 1.16 | *, *, registry.redhat.io/openshift-gitops-1/must-gather-rhel8@sha256:2f35704b4a52925cbe845743de00c271ac07accd5a59c2d215b2b80491f72c0b_ppc64le |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:52ffe54a0935e54b8d7712a01f65beb6030524a6bc5ea3ae2f59bc1b75fb5ef7_amd64 as a component of Red Hat OpenShift GitOps 1.16 | registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator@sha256:52ffe54a0935e54b8d7712a01f65beb6030524a6bc5ea3ae2f59bc1b75fb5ef7_amd64, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:3a2a9cea446951e9ce350b51197a8a5c01691ec7b5ffc149a66ca9e3134a82a0_ppc64le as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:94e8b2edf66de66d8ed7a9acaeb49ecd11e07f828d0a4be642d87cdedbf6e8a4_arm64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel8@sha256:914953316db02f903e76941af5716c25aa38c73ace8b297f11fbcb6d859aff6f_amd64 as a component of Red Hat OpenShift GitOps 1.16 | *, *, registry.redhat.io/openshift-gitops-1/must-gather-rhel8@sha256:914953316db02f903e76941af5716c25aa38c73ace8b297f11fbcb6d859aff6f_amd64 |
…and 19 more
Timeline
- Oct 9, 2025 CVE Published
- May 7, 2026 Distribution Patch
- May 7, 2026 Distribution Patch
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- Aug 6, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:17730 advisory
- https://access.redhat.com/security/cve/CVE-2025-59531 advisory
- https://access.redhat.com/security/cve/CVE-2025-59537 advisory
- https://access.redhat.com/security/cve/CVE-2025-59538 advisory
- https://access.redhat.com/security/cve/CVE-2025-55191 advisory
- https://access.redhat.com/security/cve/CVE-2025-22874 advisory
- https://access.redhat.com/security/cve/CVE-2025-47907 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.16/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17730.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2372320 issue
- https://www.cve.org/CVERecord?id=CVE-2025-22874 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22874 advisory
- https://go.dev/cl/670375 advisory
- https://go.dev/issue/73612 advisory
- https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A advisory
- https://pkg.go.dev/vuln/GO-2025-3749 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2387083 issue
- https://www.cve.org/CVERecord?id=CVE-2025-47907 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-47907 advisory
…and 25 more