RHSA-2023:5206 - Security Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security (RHACS).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The release of RHACS 4.2 provides these changes:

Security Fix(es):

• stackrox: Missing HTTP security headers allows for clickjacking in web UI (CVE-2023-4958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

New Features

RHACS 4.2 includes the following new features, improvements, and updates:

Platform

• Bring your own PostgreSQL database for RHACS Central (Technology Preview)
• The CORE BPF collection method is now GA
• RHACS Product usage report
• Performance improvements for the Compliance dashboard

Vulnerability management

• Vulnerability scanning support for Registry Mirrors in OpenShift Container Platform
• Configure delegated image scanning in the RHACS portal
• Define new system policies using CVE age or fixability
• On-demand and downloadable CVE report in Vulnerability Management 2.0
• Scanner supports additional operating systems

Network Security

• Improvements to runtime network policy generation
• Build time Network Policy tools (Technology Preview)
• New Listening Endpoints menu in the RHACS portal
• Viewing network policy YAML files from a violation

For notable technical changes, deprecated and removed features, and bug fixes, see the Release Notes.

Solution

To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le

Fixes

• BZ - 1990363 - CVE-2023-4958 stackrox: Missing HTTP security headers allows for clickjacking in web UI
• ROX-19688 - Release RHACS 4.2.0

CVEs

• CVE-2023-3899
• CVE-2023-4958

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://docs.openshift.com/acs/4.2/release_notes/42-release-notes.html