Lucene search

RedHatRHSA-2024:1570

HistoryMar 28, 2024 - 8:47 p.m.

(RHSA-2024:1570) Important: ACS 4.4 enhancement and security update

2024-03-2820:47:45

access.redhat.com

red hat advanced cluster security

compliance capabilities

network graph enhancements

build-time network policy tools

init-bundle graphical user interface

ebpf co-re collection

rhacs central

rosa hosted control plane

openshift cluster manager

paladin cloud

red hat openshift sccs

cluster discovery

short-lived api tokens

roxctl cli

aws and gcp integrations

scanner v4

claircore

golang

go-git

helm

security fixes.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.962 High

EPSS

Percentile

99.5%

JSON

Updated images are now available for Red Hat Advanced Cluster Security. The
updated image includes new features and bug fixes.

This release includes the following features and updates:

New Compliance capabilities (Technology Preview)
Network graph enhancements for internal entities
Build-time network policy tools is now generally available
Init-bundle graphical user interface improvements
eBPF CO-RE collection method enabled by default
Bring your own database for RHACS Central is now generally available
Support RHACS on ROSA hosted control plane
Life cycle updates
Integration with Red Hat OpenShift Cluster Manager and Paladin Cloud to discover unsecured clusters
Migration to stock Red Hat OpenShift SCCs during manual upgrade by using roxctl CLI
Cluster discovery by using cloud source integrations
Short-lived API tokens for Central
Enhanced roxctl deployment check command
Authentication of AWS and GCP integrations by using short-lived tokens (Technology Preview)
Scanner V4 that uses upstream ClairCore (Technology Preview)
Filter workload CVEs by using component and component source

For more information, including bug fix descriptions, see https://docs.openshift.com/acs/4.4/release_notes/44-release-notes.html.

Security fixes:

golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)
go-git: Maliciously crafted Git server replies can cause DoS on go-git clients (CVE-2023-49568)
helm: Missing YAML content leads to panic (CVE-2024-26147)
helm: Shows secrets with --dry-run option in clear text (CVE-2019-25210)