OCPBUGS-105555: Update ubi-minimal base image to fix glib2 CVEs (CVE-2025-14087, CVE-2025-14512)

[redhat-chai-bot]

Summary

Updates ubi-minimal base image from 9.7-1777857961 to 9.7-1779770818 in both Containerfile.operator and Containerfile.control-plane to fix CVE-2025-14087 and CVE-2025-14512 (glib2).

Details

• Vulnerable package: glib2-2.68.4-18.el9_7.1 (in ubi-minimal:9.7-1777857961)
• Fixed package: glib2-2.68.4-18.el9_7.2 (in ubi-minimal:9.7-1779770818)
• Advisory: RHSA-2026:15971 (Moderate, shipped 2026-05-11)
• CVEs:
  • CVE-2025-14087 — GVariant parser buffer underflow, heap corruption (CVSS 5.6)
  • CVE-2025-14512 — GIO integer overflow, heap buffer overflow (CVSS 6.5)

Verification

Confirmed via podman run --rm <image> rpm -q glib2:

• ubi-minimal:9.7-1777857961 → glib2-2.68.4-18.el9_7.1 (vulnerable)
• ubi-minimal:9.7-1779770818 → glib2-2.68.4-18.el9_7.2 (fixed)

Context

Microsoft security scanners flagged this CVE in the Konflux-built hypershift-operator image at quay.io/redhat-services-prod/crt-redhat-acm-tenant/hypershift/hypershift-operator. Deadline: ~2026-09-04.

Previous base image update: #7983

---

AI-generated. Review for accuracy.

@Nirshal requested in Slack thread

Summary by CodeRabbit

• Chores
  • Updated the runtime container base image to the latest 9.7-1779770818 build for improved consistency and maintenance.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-105555, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Updates ubi-minimal base image from 9.7-1777857961 to 9.7-1779770818 in both Containerfile.operator and Containerfile.control-plane to fix CVE-2025-14087 and CVE-2025-14512 (glib2).

Details

• Vulnerable package: glib2-2.68.4-18.el9_7.1 (in ubi-minimal:9.7-1777857961)
• Fixed package: glib2-2.68.4-18.el9_7.2 (in ubi-minimal:9.7-1779770818)
• Advisory: RHSA-2026:15971 (Moderate, shipped 2026-05-11)
• CVEs:
• CVE-2025-14087 — GVariant parser buffer underflow, heap corruption (CVSS 5.6)
• CVE-2025-14512 — GIO integer overflow, heap buffer overflow (CVSS 6.5)

Verification

Confirmed via podman run --rm <image> rpm -q glib2:

• ubi-minimal:9.7-1777857961 → glib2-2.68.4-18.el9_7.1 (vulnerable)
• ubi-minimal:9.7-1779770818 → glib2-2.68.4-18.el9_7.2 (fixed)

Context

Microsoft security scanners flagged this CVE in the Konflux-built hypershift-operator image at quay.io/redhat-services-prod/crt-redhat-acm-tenant/hypershift/hypershift-operator. Deadline: ~2026-09-04.

Previous base image update: #7983

---

AI-generated. Review for accuracy.

@Nirshal requested in Slack thread

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

The runtime base image tag changed from 9.7-1777857961 to 9.7-1779770818 in both Containerfile.control-plane and Containerfile.operator.

Suggested reviewers: bryan-cox

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the UBI minimal base image update and the glib2 CVEs addressed, matching the main changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	HEAD changes only two Containerfiles, replacing static image tags; no Ginkgo test APIs, test files, or dynamic test titles changed.
Test Structure And Quality	✅ Passed	The pull request changes only two Containerfiles to update the UBI image tag; it adds or modifies no Ginkgo tests, so the test-structure check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The parent diff changes only two Containerfiles, and both changes only the UBI base-image tag; no deployment, controller, operator, or scheduling constraint was modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The parent-to-HEAD diff changes only two Containerfiles, updating base image tags; it adds no Ginkgo tests or test connectivity assumptions.
No-Weak-Crypto	✅ Passed	The commit changes only two ubi-minimal FROM tags; no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret-comparison code is added.
Container-Privileges	✅ Passed	The pull request only changes two UBI image tags. The added lines contain no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or root-user settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit only changes two UBI image tags; neither added line contains logging code, credentials, tokens, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Containerfile.control-plane`:
- Line 11: Replace the build-specific UBI base tag in
Containerfile.control-plane:11-11 and Containerfile.operator:12-12 with the
approved floating UBI tag, keeping both runtime images consistent;
alternatively, document the exception and define an automated refresh process
for the pinned tag.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: eed13921-73a9-4568-a793-57d8054403e4

📥 Commits

Reviewing files that changed from the base of the PR and between 86a075c and 67ab77a.

📒 Files selected for processing (2)

• Containerfile.control-plane
• Containerfile.operator

[redhat-chai-bot]

/area hypershift-operator

---

AI-generated. Review for accuracy.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.67%. Comparing base (86a075c) to head (a4ea261).
⚠️ Report is 21 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9276   +/-   ##
=======================================
  Coverage   45.67%   45.67%           
=======================================
  Files         781      781           
  Lines       97726    97726           
=======================================
  Hits        44641    44641           
  Misses      50019    50019           
  Partials     3066     3066           

Flag	Coverage Δ
cmd-support	38.79% <ø> (ø)
cpo-hostedcontrolplane	47.84% <ø> (ø)
cpo-other	45.89% <ø> (ø)
hypershift-operator	56.97% <ø> (ø)
other	34.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Nirshal]

/jira refresh

[Nirshal]

/retest

[openshift-ci-robot]

@Nirshal: This pull request references Jira Issue OCPBUGS-105555, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

[Nirshal]

The gitlint check is failing with B6 Body message is missing — the commit message has no body after the title line.

Please amend the commit to add a body, e.g.:

fix: OCPBUGS-105555: Update ubi-minimal base image to fix glib2 CVEs

Updates ubi-minimal from 9.7-1777857961 to 9.7-1779770818 in both
Containerfile.operator and Containerfile.control-plane to fix
CVE-2025-14087 and CVE-2025-14512 (glib2).

[redhat-chai-bot]

Thanks @Nirshal — the commit body has been added and force-pushed. Gitlint is now passing. ✅

---

AI-generated. Review for accuracy.

[Nirshal]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, redhat-chai-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bryan-cox]

/verified by RHTAP CI jobs

[openshift-ci-robot]

@bryan-cox: This PR has been marked as verified by RHTAP CI jobs.

Details

In response to this:

/verified by RHTAP CI jobs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[redhat-chai-bot]

/retest-required e2e-v2-azure-self-managed

The failure was an Azure network connectivity issue — dial tcp [2603:1037:1:138::81]:443: connect: network is unreachable when reaching graph.microsoft.com. Unrelated to this PR's base image change.

---

AI-generated. Review for accuracy.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD ab71ef1 and 2 for PR HEAD a4ea261 in total

[cwbotbot]

Test Results

e2e-aws

• Status: ✅ PASS
• Started: 2026-08-11T14:28:48Z
• View Job
• View Job History

e2e-aks

• Status: ✅ PASS
• Started: 2026-08-11T14:28:47Z
• View Job
• View Job History

[redhat-chai-bot]

/retest-required

Second e2e-v2-azure-self-managed failure is a 15-minute test timeout during artifact dump — different from the first failure (network unreachable). Both are infrastructure issues unrelated to this base image change.

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

/retest-required

ci/prow/images and ci/prow/security failed on a re-run — all e2e tests passed. These tests were passing on earlier runs of this same commit; likely transient CI infrastructure issues.

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

/retest security

ci/prow/security failed again on a re-run — transient CI issue. ci/prow/images passed on retest.

---

AI-generated. Review for accuracy.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 52557a1 and 1 for PR HEAD a4ea261 in total

[redhat-chai-bot]

/test security

Snyk code scan service failure — not related to this PR. Retesting.

---

AI-generated. Review for accuracy.

[inbharajmani]

/test security

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 488ab43 and 0 for PR HEAD a4ea261 in total

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@redhat-chai-bot: Jira Issue Verification Checks: Jira Issue OCPBUGS-105555
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-105555 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Summary

Updates ubi-minimal base image from 9.7-1777857961 to 9.7-1779770818 in both Containerfile.operator and Containerfile.control-plane to fix CVE-2025-14087 and CVE-2025-14512 (glib2).

Details

• Vulnerable package: glib2-2.68.4-18.el9_7.1 (in ubi-minimal:9.7-1777857961)
• Fixed package: glib2-2.68.4-18.el9_7.2 (in ubi-minimal:9.7-1779770818)
• Advisory: RHSA-2026:15971 (Moderate, shipped 2026-05-11)
• CVEs:
• CVE-2025-14087 — GVariant parser buffer underflow, heap corruption (CVSS 5.6)
• CVE-2025-14512 — GIO integer overflow, heap buffer overflow (CVSS 6.5)

Verification

Confirmed via podman run --rm <image> rpm -q glib2:

• ubi-minimal:9.7-1777857961 → glib2-2.68.4-18.el9_7.1 (vulnerable)
• ubi-minimal:9.7-1779770818 → glib2-2.68.4-18.el9_7.2 (fixed)

Context

Microsoft security scanners flagged this CVE in the Konflux-built hypershift-operator image at quay.io/redhat-services-prod/crt-redhat-acm-tenant/hypershift/hypershift-operator. Deadline: ~2026-09-04.

Previous base image update: #7983

---

AI-generated. Review for accuracy.

@Nirshal requested in Slack thread

Summary by CodeRabbit

• Chores
• Updated the runtime container base image to the latest 9.7-1779770818 build for improved consistency and maintenance.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.