(RHSA-2024:1549) Critical: ACS 4.3 enhancement and security update

2024-03-2718:45:05

access.redhat.com

rhacs 4.3.6

bug fix

jira notifier

security fixes

go-git

path traversal

rce

helm

yaml

panic

secrets

cvss score

references

cve page

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.5%

JSON

This release of RHACS 4.3.6 provides the following bug fix:

Fixed an issue where an incorrectly configured Jira notifier causes the Central component of RHACS to enter a crash loop

It provides the following security fixes:

go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients (CVE-2023-49569)
helm: Missing YAML content leads to panic (CVE-2024-26147)
helm: Shows secrets with --dry-run option in clear text (CVE-2019-25210)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.