(RHSA-2024:6708) Moderate: ACS 4.5 enhancement and security update

2024-09-1618:25:39

access.redhat.com

rhacs 4.5.2

security update

cve-2024-3727

enhancement

containers/image

bug fixes

vulnerability management

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

7.3

Confidence

Low

JSON

This release of RHACS 4.5.2 includes the security fix for the following CVE:

containers/image: digest type does not guarantee valid type (CVE-2024-3727)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This release of RHACS fixes the following bugs:

Fixed an issue where Sensor was unable to identify OpenShift Container Platform internal registry secrets due to a change in the pull secret annotation.
Fixed an issue where policies incorrectly displayed an enforced value of Yes in the Configuration Management -> Application & Infrastructure -> Deployments page due to inconsistent status handling, while showing No in the Violations page.
Fixed an issue where vulnerability data differed between the Vulnerability Management Workload CVE pages and the deprecated Vulnerability Management dashboard due to inconsistencies in vulnerability reporting.