The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: container-tools:rhel8 security update

buildah

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

* github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload (CVE-2025-65637)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The RHTAS Operator can be used with OpenShift Container Platform 4.15, 4.16, 4.17, 4.18 and 4.19

Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release

The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.

Red Hat Security Advisory: DevWorkspace Operator 0.39.0 release.

The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, and 4.20

Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

An update is now available for Red Hat OpenShift GitOps.
Bug Fix(es) and Enhancement(s):
* GITOPS-8231 (CVE-2025-47913 openshift-gitops-1/argocd-agent-rhel8: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [gitops-1.17])
* GITOPS-8233 (CVE-2025-47913 openshift-gitops-1/argocd-rhel9: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [gitops-1.17])
* GITOPS-8078 (CVE-2025-58183 openshift-gitops-1/argocd-rhel8: Unbounded allocation when parsing GNU sparse map [gitops-1.17])
* GITOPS-8081 (CVE-2025-58183 openshift-gitops-1/dex-rhel8: Unbounded allocation when parsing GNU sparse map [gitops-1.17])
* GITOPS-7753 (CVE-2025-58754 openshift-gitops-1/argocd-extensions-rhel8: Axios DoS via lack of data size check [gitops-1.17])
* GITOPS-8511 (CVE-2025-68156 openshift-gitops-1/argocd-rhel8: Expr: Denial of Service via uncontrolled recursion in expression evaluation [gitops-1.17])
* GITOPS-8512 (CVE-2025-68156 openshift-gitops-1/argocd-rhel9: Expr: Denial of Service via uncontrolled recursion in expression evaluation [gitops-1.17])
* GITOPS-7568 (ignoreDifferences setting is not honored for OAuthClient resource)
* GITOPS-7992 (openshift-gitops-operator-metrics-monitor ServiceMonitor is attempting to use a bearerTokenFile configuration in its endpoints definition)
* GITOPS-8225 (RC 1.19.0-2 : haproxy replica remains 1 with HA upgrade)
* GITOPS-8411 (CVE-2025-55190 still blocking due to github.com/argoproj/argo-cd/v2@v2.14.11 in gitops-rhel8:v1.18.1)
* GITOPS-8591 (Reciving TargetDown after upgrading GitOps )

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.4 security update

VolSync v0.14 is a Kubernetes operator that enables asynchronous
replication of persistent volumes within a cluster, or across clusters. After
deploying the VolSync operator, it can create and maintain copies of your
persistent data.

For more information about VolSync, see:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/business_continuity/business-cont-overview#volsync

or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.

Red Hat Security Advisory: VolSync v0.14 security fixes and container updates

Releases of Red Hat OpenShift Builds 1.6.1

Red Hat Security Advisory: Red Hat OpenShift Builds 1.6.1

golang-go.crypto

snapd

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

Golang go.crypto: SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic… (CVE-2025-47913)

agent

CVE-2025-47913 is a high-severity vulnerability in the golang.org/x/crypto SSH agent package where SSH clients panic and terminate unexpectedly upon receiving an SSH_AGENT_SUCCESS message when a typed response is expected. This improper handling of exceptional conditions (CWE-703) leads to denial of service by crashing the client process without requiring authentication or user interaction. The vulnerability affects all versions of the golang.org/x/crypto/ssh/agent package and has a CVSS score of 7.5, indicating significant impact on availability. No known exploits are currently reported in the wild. European organizations using Go-based SSH clients that rely on this package may face service disruptions, particularly in critical infrastructure and development environments. Mitigation involves updating to patched versions once available and implementing robust error handling around SSH agent responses. Countries with strong software development sectors and critical infrastructure relying on Go are most at risk, including Germany, France, the UK, and the Netherlands.

Search: CVE-2025-47913