RHBA-2025:14114 - Bug Fix Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security (RHACS).

Description

This release of ACS 4.7 provides the following bug fix:

• Before this update, the upgrade to Golang gRPC 1.67 and later caused problems with gRPC connections that affected multiple users. This issue prevented gRPC connections and blocked communications between Central and Sensor. With this release, the `GRPC_ENFORCE_ALPN_ENABLED` flag has been added in {product-title-short}. The default value disables the Application-Layer Protocol Negotiation (ALPN) enforcement, and therefore allows the connection between Sensor and Central as well as the communication between the components.

This release also addresses security vulnerabilities, including those listed in the CVEs section.

Solution

If you are using an earlier version of RHACS 4.7, you are advised to upgrade to patch release 4.7.6.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le
• Red Hat Advanced Cluster Security for Kubernetes for ARM 4 aarch64

Fixes

• ROX-30522 - Release RHACS 4.7.6

CVEs

• CVE-2024-34397
• CVE-2024-47081
• CVE-2024-52533
• CVE-2025-4373
• CVE-2025-6965
• CVE-2025-8058
• CVE-2025-32415
• CVE-2025-40909

References

• https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.7/html/release_notes/index