STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

DISA Rule

SV-257561r1156740_rule

Vulnerability Number

V-257561

Group Title

SRG-APP-000384-CTR-000915

Rule Version

CNTR-OS-000740

Severity

CAT II

CCI(s)

• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

By default, the integrity of RH CoreOS is checked by cluster version operator on OpenShift platform. If the integrity is not verified, reinstall of the cluster is necessary.

Refer to instructions:
https://docs.openshift.com/container-platform/4.10/installing/index.html

Where OpenShift Virtualization is enabled:
Annotations must be removed from the Hyperconverged by directly editing the object with oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv or by removing the annotation with the annotate command.

Example:
$ oc annotate --overwrite -n openshift-cnv hco
kubevirt-hyperconverged
'containerizeddataimporter.kubevirt.io/jsonpatch-'

Check Contents

To verify integrity of the cluster version, execute the following:
oc get clusterversion version

If the Cluster Version Operator is not installed or the AVAILABLE is not set to "True", this is a finding.

Run the following command to retrieve the Cluster Version objects in the system:
oc get clusterversion version -o yaml

If 'verified: true', under status history for each item is not present, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("kubevirt.kubevirt.io/jsonpatch")'

$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("containerizeddataimporter.kubevirt.io/jsonpatch")'

$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("networkaddonsconfigs.kubevirt.io/jsonpatch")'

$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("ssp.kubevirt.io/jsonpatch")'

If any results are returned aside from empty strings, this is a finding.

Vulnerability Number

V-257561

Documentable

False

Rule Version

CNTR-OS-000740

Severity Override Guidance

To verify integrity of the cluster version, execute the following:
oc get clusterversion version

If the Cluster Version Operator is not installed or the AVAILABLE is not set to "True", this is a finding.

Run the following command to retrieve the Cluster Version objects in the system:
oc get clusterversion version -o yaml

If 'verified: true', under status history for each item is not present, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("kubevirt.kubevirt.io/jsonpatch")'

$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("containerizeddataimporter.kubevirt.io/jsonpatch")'

$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("networkaddonsconfigs.kubevirt.io/jsonpatch")'

$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o
jsonpath='{.metadata.annotations}'| jq
'.|has("ssp.kubevirt.io/jsonpatch")'

If any results are returned aside from empty strings, this is a finding.

Check Content Reference

M

Target Key

5547