RHSA-2024:4836 - Security Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes new features, bug fixes, and updates to patch vulnerabilities.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Release of RHACS 4.5 provides these changes:

New features:

• Scanner V4 is generally available
• Vulnerability Management 2.0 is generally available
• Compliance updates
• Built-in email notifier in RHACS Cloud Service
• roxctl installation GitHub action
• Bring your own PKI for signature verification
• Build-time network policy tools updates
• Enhanced RHACS Cloud Service experience

This releases updates the following items to patch vulnerabilities:

• (CVE-2024-28849) The `follow-redirect` module was updated to 1.15.6.
• (CVE-2024-29903) Updated `cosign` to 2.2.4.
• (CVE-2024-29902) Updated `cosign` to 2.2.4.

For more information on new features and other details, see https://docs.openshift.com/acs/4.5/release_notes/45-release-notes.html.

Solution

To take advantage of the new features, bug fixes, and enhancements in RHACS 4.5, you are advised to upgrade to RHACS 4.5.0.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le

Fixes

• BZ - 2269576 - CVE-2024-28849 follow-redirects: Possible credential leak
• BZ - 2274504 - CVE-2024-29903 cosign: Malicious artifects can cause machine-wide denial of service
• BZ - 2274508 - CVE-2024-29902 cosign: Malicious attachments can cause system-wide denial of service
• ROX-25325 - Release RHACS 4.5.0

CVEs

• CVE-2022-48624
• CVE-2023-2953
• CVE-2024-3651
• CVE-2024-24806
• CVE-2024-25629
• CVE-2024-28182
• CVE-2024-28849
• CVE-2024-29902
• CVE-2024-29903
• CVE-2024-32487

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://docs.openshift.com/acs/4.5/release_notes/45-release-notes.html