STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift runtime must have updates installed within the period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).

DISA Rule

SV-257572r1137650_rule

Vulnerability Number

V-257572

Group Title

SRG-APP-000456-CTR-001130

Rule Version

CNTR-OS-000900

Severity

CAT II

CCI(s)

• CCI-002605 - Install security-relevant software updates within an organization-defined time period of the release of the updates.

Weight

10

Fix Recommendation

For container images that are not scheduled to check for updates that otherwise should, update the imagestream to schedule updates for each tag by executing the following:

oc patch imagestream <NAME> -n NAMESPACE --type merge -p '{"spec":{"tags":[{"name":"<TAG_NAME>","importPolicy":{"scheduled":true}}]}}'

where,
NAME: The imagestream name to update
NAMESPACE: The namespace the imagestream is in. This will most often be 'openshift'.
TAG_NAME: The imagestream tag to update

Check Contents

To list all the imagestreams and identify which imagestream tags are configured to periodically check for updates (imagePolicy = { scheduled: true }), execute the following:

oc get imagestream --all-namespaces -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{range .spec.tags[*]}{"\t"}{.name}{": "}{.importPolicy}{"\n"}'

The output will be similar to:

httpd
2.4: {}
2.4-el7: {}
2.4-el8: {}
latest: {}
:
installer
latest: {"scheduled":true}
:
installer-artifacts
latest: {"scheduled":true}
:

Review the listing, and for each imagestream tag version that does not have the value '{"scheduled":true}' that should otherwise check for updates, this is a finding.

Vulnerability Number

V-257572

Documentable

False

Rule Version

CNTR-OS-000900

Severity Override Guidance

To list all the imagestreams and identify which imagestream tags are configured to periodically check for updates (imagePolicy = { scheduled: true }), execute the following:

oc get imagestream --all-namespaces -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{range .spec.tags[*]}{"\t"}{.name}{": "}{.importPolicy}{"\n"}'

The output will be similar to:

httpd
2.4: {}
2.4-el7: {}
2.4-el8: {}
latest: {}
:
installer
latest: {"scheduled":true}
:
installer-artifacts
latest: {"scheduled":true}
:

Review the listing, and for each imagestream tag version that does not have the value '{"scheduled":true}' that should otherwise check for updates, this is a finding.

Check Content Reference

M

Target Key

5547