RHBA-2025:8931 - Bug Fix Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security (RHACS).

Description

This release of RHACS 4.6 provides the following bug fixes:

• Fixed an issue where images were mistakenly pruned when the inactive images retention value was set to 0. This action caused resetting of the firstDiscovered and firstImageOccurrence values for CVEs.
• Fixed an issue with the web portal where you could not scroll when assigning roles to an auth provider.

This release provides fixes for these security issues:

• zlib: Out-of-bounds pointer arithmetic in inftrees.c (CVE-2016-9840)
• krb5: Kerberos RC4-HMAC-MD5 checksum vulnerability (CVE-2025-3576)

Solution

If you are using an earlier version of RHACS 4.6, you are advised to upgrade to patch release 4.6.7.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le
• Red Hat Advanced Cluster Security for Kubernetes for ARM 4 aarch64

Fixes

• ROX-29611 - Release RHACS 4.6.7

CVEs

• CVE-2016-9840
• CVE-2025-3576

References

• https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.6/html/release_notes/index