RHSA-2025:2567 - Security Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security (RHACS).

Description

This release of RHACS 4.6 provides these changes:

• Fix rhacs-main-container: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (CVE-2025-22868)
• ROX-27347: Fix vulnerability report job getting stuck in waiting state after central restart

Solution

If you are using an earlier version of RHACS 4.6, you are advised to upgrade to patch release 4.6.3.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le
• Red Hat Advanced Cluster Security for Kubernetes for ARM 4 aarch64

Fixes

• ROX-28411 - Release RHACS 4.6.3

CVEs

• CVE-2020-11023
• CVE-2022-49043
• CVE-2024-11187
• CVE-2025-1094
• CVE-2025-1244
• CVE-2025-22868

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.6/html/release_notes/release-notes-46