Update OLM registry builder to v4.21 to fix CVE-2025-68121#689
Update OLM registry builder to v4.21 to fix CVE-2025-68121#689BATMAN-JD wants to merge 1 commit intoopenshift:masterfrom
Conversation
Update ose-operator-registry-rhel9 from v4.19 to v4.21 in the Dockerfile.olm-registry template to resolve CVE-2025-68121 (CRITICAL - CVSS 10) in Go stdlib. The vulnerability exists in Go binaries (registry-server, grpc_health_probe, initializer) compiled with Go v1.23.10 in the v4.19 builder image. v4.21 was built on Feb 24, 2026 with patched Go stdlib and does not contain CVE-2025-68121. This affects all consuming repositories using this template for OLM registry builds. Related: SREP-3588
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: BATMAN-JD The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Note on Test FailuresThe
I verified locally that these same 2 tests fail on clean master (before my change), and the 6 other tests pass successfully on both master and my branch. This one-line change (v4.19 → v4.21) does not introduce any new test failures. The |
| @@ -1,4 +1,4 @@ | |||
| FROM registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.19 AS builder | |||
| FROM registry.redhat.io/openshift4/ose-operator-registry-rhel9:v4.21 AS builder | |||
There was a problem hiding this comment.
You should build an operators catalog registry with this and ensure you can run it
2 participants
Summary
Update OLM registry builder from v4.19 to v4.21 to fix CVE-2025-68121 (CRITICAL - CVSS 10) in Go stdlib.
Problem
CVE-2025-68121 exists in Go binaries (
registry-server,grpc_health_probe,initializer) compiled with Go v1.23.10 in thev4.19 builder image. This affects all repositories using this template for OLM catalog builds.
Affected: Production, stage, and integration environments across all 17 consumer repositories.
Solution
v4.21 (built Feb 24, 2026) is the latest stable version with the patched Go stdlib. Trivy scan confirms 0 CRITICAL CVEs.
References