STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must use TLS 1.2 or greater for secure container image transport from trusted sources.

DISA Rule

SV-257505r960759_rule

Vulnerability Number

V-257505

Group Title

SRG-APP-000014-CTR-000035

Rule Version

CNTR-OS-000010

Severity

CAT II

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

Remove insecure registries from the cluster's image registry configuration by executing the following:

oc edit image.config.openshift.io/cluster

Edit or remove any registries where insecure is set to true or are listed under insecureRegistries.

Refer to https://docs.openshift.com/container-platform/4.8/openshift_images/image-configuration.html for more details on configuring registries in OpenShift.

Check Contents

Verify that no insecure registries are configured by executing the following:

oc get image.config.openshift.io/cluster -ojsonpath='{.spec.allowedRegistriesForImport}' | jq -r '.[] | select(.insecure == true)'

If the above query finds any registries, this is a finding. Empty output is not a finding.

Verify that no insecure registries are configured by executing the following:

oc get image.config.openshift.io/cluster -ojsonpath='{.spec.registrySources.insecureRegistries}'

If the above query returns anything, then this is a finding. Empty output is not a finding.

Vulnerability Number

V-257505

Documentable

False

Rule Version

CNTR-OS-000010

Severity Override Guidance

Verify that no insecure registries are configured by executing the following:

oc get image.config.openshift.io/cluster -ojsonpath='{.spec.allowedRegistriesForImport}' | jq -r '.[] | select(.insecure == true)'

If the above query finds any registries, this is a finding. Empty output is not a finding.

Verify that no insecure registries are configured by executing the following:

oc get image.config.openshift.io/cluster -ojsonpath='{.spec.registrySources.insecureRegistries}'

If the above query returns anything, then this is a finding. Empty output is not a finding.

Check Content Reference

M

Target Key

5547