RHSA-2025:3928 - Security Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security (RHACS).

Description

This release of RHACS includes the following bug fix:

• Fixed a bug to match the aggregation field of the compliance tables to the widgets for consistency.

This release also addresses the following security vulnerabilities:

• RHSA-2025:2679: libxml2 security update
• RHSA-2025:1350: libxml2 security update
• RHSA-2025:1330: openssl security update
• CVE-2024-57083: Prototype pollution in redoc can allow a DoS attack
• CVE-2024-21536: Flaw in `http-proxy-middleware` package
• CVE-2025-30204: Flaw in the golang-jwt implementation of JSON Web Tokens (JWT)

Solution

If you are using an earlier version of RHACS 4.5, you are advised to upgrade to patch release 4.5.9.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le

Fixes

• BZ - 2319884 - CVE-2024-21536 http-proxy-middleware: Denial of Service
• BZ - 2354195 - CVE-2025-30204 golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
• BZ - 2355865 - CVE-2024-57083 redoc: Prototype Pollution in redoc

CVEs

• CVE-2024-21536
• CVE-2024-57083
• CVE-2025-30204

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.5/html/release_notes/index