OpenShift must contain only container images for those capabilities being offered by the container platform.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-257538 | CNTR-OS-000380 | SV-257538r960963_rule | CCI-000381 | medium |
| Description | ||||
| Allowing container images to reside within the container platform registry that are not essential to the capabilities being offered by the container platform becomes a potential security risk. By allowing these nonessential container images to exist, the possibility for accidental instantiation exists. The images may be unpatched, not supported, or offer nonapproved capabilities. Those images for customer services are considered essential capabilities. | ||||
| STIG | Date | |||
| Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide | 2025-05-15 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.6
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000381
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-257538r960963_chk)
To review the container images within the container platform registry, execute the following:
oc get images
Review the container platform container images to validate that only container images necessary for the functionality of the information system are present. If unnecessary container images exist, this is a finding.
Fix Text (F-61197r921556_fix)
Remove any images from the container registry that are not required for the functionality of the system by executing the following:
oc delete image <IMAGE_NAME> -n <IMAGE_NAMESPACE>