STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must remove old components after updated versions have been installed.

DISA Rule

SV-257570r961677_rule

Vulnerability Number

V-257570

Group Title

SRG-APP-000454-CTR-001110

Rule Version

CNTR-OS-000880

Severity

CAT II

CCI(s)

• CCI-002617 - Remove previous versions of organization-defined software components after updated versions have been installed.

Weight

10

Fix Recommendation

Enable the image pruner to automate the pruning of images from the cluster by executing the following:

oc patch imagepruners.imageregistry.operator.openshift.io/cluster --type=merge -p '{"spec":{"suspend":false}}'

For additional details on configuring the image pruner operator, refer to the following document:
https://docs.openshift.com/container-platform/4.8/applications/pruning-objects.html#pruning-images_pruning-objects

Check Contents

Ensure the imagepruner is configured and is not in a suspended state by executing the following:

oc get imagepruners.imageregistry.operator.openshift.io/cluster -o jsonpath='{.spec}{"\n"}'

Review the settings. If "suspend" is set to "true", this is a finding.

Vulnerability Number

V-257570

Documentable

False

Rule Version

CNTR-OS-000880

Severity Override Guidance

Ensure the imagepruner is configured and is not in a suspended state by executing the following:

oc get imagepruners.imageregistry.operator.openshift.io/cluster -o jsonpath='{.spec}{"\n"}'

Review the settings. If "suspend" is set to "true", this is a finding.

Check Content Reference

M

Target Key

5547