RHBA-2024:1830 - Bug Fix Advisory

Topic

An updated OpenShift Compliance Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.

Description

The OpenShift Compliance Operator v1.4.1 is now available. See the documentation for bug fix information:

https://docs.openshift.com/container-platform/4.15/security/compliance_operator/compliance-operator-release-notes.html

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html

Affected Products

• Red Hat OpenShift Container Platform 4.13 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.8 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.7 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.6 for RHEL 8 x86_64

Fixes

• OCPBUGS-13589 - Rule upstream-ocp4-kubelet-enable-protect-kernel-sysctl-file-exist fail for rhel9 based RHCOS systems
• OCPBUGS-18331 - Applying remediations in RHOCP 4.13 unexpectedly disable users login
• OCPBUGS-26193 - The OCP4 STIG profile is missing existing rules from CaC/content
• OCPBUGS-26229 - Scan setting binding validation is inconsistent when using multiple products
• OCPBUGS-28242 - Rule rhcos4-service-debug-shell-disabled show as FAIL after auto-remediation applied
• OCPBUGS-28797 - The instructions for rule rhcos4-banner-etc-issue is not helpful
• OCPBUGS-28918 - api_server_api_priority_flowschema_catch_all fails on OpenShift 4.16
• OCPBUGS-29272 - Compliance Scan does not gets deleted after removing profile from SSB
• CMP-2401 - Add OCP4 STIG IDs and SRGs to profile rules
• CMP-2471 - Disable rules on s390x
• OCPBUGS-32797 - Metrics service is missing for Compliance Operator v1.4.1 on Power
• OCPBUGS-33067 - On hypershift hosted cluster, a scan with ocp4-pci-dss profile will run into fatal error due to filter cannot iterate
• OCPBUGS-33458 - Default Scan setting roles is set to all instead of master,worker on Power
• CMP-2331 - ocp4-cis-api-server-api-priority-gate-enabled rule is failing even if APIPriorityAndFairness enabled

CVEs

• CVE-2021-35937
• CVE-2021-35938
• CVE-2021-35939
• CVE-2021-43618
• CVE-2023-2602
• CVE-2023-2603
• CVE-2023-3446
• CVE-2023-3817
• CVE-2023-4527
• CVE-2023-4806
• CVE-2023-4813
• CVE-2023-4911
• CVE-2023-5678
• CVE-2023-5981
• CVE-2023-7104
• CVE-2023-28322
• CVE-2023-29491
• CVE-2023-38546
• CVE-2023-39615
• CVE-2023-44487
• CVE-2023-46218
• CVE-2023-48795
• CVE-2023-52425
• CVE-2024-0553
• CVE-2024-2961

References

(none)