This advisory covers multiple security issues fixed in Red Hat OpenShift GitOps v1.17.4, notably CVE-2025-47913, a vulnerability in the golang.org/x/crypto/ssh/agent package. The flaw causes the SSH client to panic when receiving an unexpected SSH_AGENT_SUCCESS message type, leading to process termination due to unhandled message unmarshalling. This vulnerability allows an attacker controlling or intercepting SSH agent traffic to cause a reliable denial of service against clients relying on SSH agent interactions. Additional vulnerabilities fixed include unbounded memory allocation parsing GNU sparse maps, denial of service via uncontrolled recursion in expression evaluation, and denial of service via lack of data size checks in Axios. The update addresses these by correcting unsafe assumptions and improving error handling. The affected versions are >=1.17.0 and <1.17.4. The vendor advisory confirms a fix is available in version 1.17.4.

The primary impact is a high-severity availability issue where a malicious or misbehaving SSH agent can cause client processes to crash, resulting in denial of service. This affects automation and developer tooling relying on SSH agent interactions, especially in environments using forwarded sockets or shared workspaces. Other vulnerabilities fixed also relate to denial of service conditions via memory exhaustion or recursion. There is no confidentiality or integrity impact reported.

A security update to Red Hat OpenShift GitOps version 1.17.4 is available and should be applied to remediate these vulnerabilities. No other mitigations meeting Red Hat's standards are currently available. Users should ensure all previously released errata are applied before updating. Refer to the Red Hat advisory for detailed update instructions.