RHSA-2025:3929 - Security Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security (RHACS).

Description

This release of RHACS fixes the following bugs:

• Fixed an issue where Central could perform image scans even when delegated scanning was enabled, due to a race condition during Sensor reconnection.
• Fixed an issue where mismatched aggregation fields in Compliance tables and widgets caused inconsistent percentage displays.
• Fixed an issue where you ran into Google Kubernetes Engine (GKE) compatibility test failures because the tests still used a deprecated service in RHACS 4.6.
• Fixed an issue where you could see the Configuration Management page despite only having Alert permissions, resulting in role-based access control (RBAC) errors.
• Fixed an issue where verifying multi-signed images failed due to incorrect error handling.

This release of RHACS fixes the following security vulnerabilities:

CVE-2024-21536: Flaw in http-proxy-middleware allowed denial of service through unhandled promise rejections in micromatch.

CVE-2025-30204: Flaw in jwt-go allowed excessive memory allocation during header parsing, which could lead to a possible denial of service.

CVE-2024-57083: Flaw in redoc allowed prototypes in mergeObjects to be tainted, which allowed a denial of service through crafted payloads.

Solution

If you are using an earlier version of RHACS 4.6, you are advised to upgrade to patch release 4.6.5.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le
• Red Hat Advanced Cluster Security for Kubernetes for ARM 4 aarch64

Fixes

• BZ - 2319884 - CVE-2024-21536 http-proxy-middleware: Denial of Service
• BZ - 2354195 - CVE-2025-30204 golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
• BZ - 2355865 - CVE-2024-57083 redoc: Prototype Pollution in redoc

CVEs

• CVE-2024-21536
• CVE-2024-55549
• CVE-2024-57083
• CVE-2025-24855
• CVE-2025-30204

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.6/html/release_notes/release-notes-46