Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Red Hat ACS 4.1 Security Enhancement RHSA-2023:3943-01 Moderate Impact

red hat
Calendar Grey June 29, 2023
Dist Redhat Esm H88
New versions of Red Hat Advanced Cluster Security images have been released, incorporating additional functionalities and improvements assessed with a moderate security impact rating.
Updated images are now available for Red Hat Advanced Cluster Security (RHACS)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The release of ACS 4.1 provides these changes:
Security Fix(es):
* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
* golang: html/template: backticks not treated as string delimiters(CVE-2023-24538)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
New features:
* Manual renewal of Central and Sensor certificates
* Vulnerability Management 2.0 (Technology Preview)
* RHACS Cloud Service scanning support for images pulled from on-premise registries
* eBPF collection method on IBM Z and IBM® LinuxONE
* Ability to configure the display of default compliance standards in the Compliance Dashboard
* Declarative configurations for authentication and authorization
* SSO configuration using the roxctl CLI
* New collection method based on BPF CO-RE (Technology Preview)
* Network graph updates
* Policy Management simplification
* New permission sets
* Improvements for Sensor resync (General Availability)
For notable technical changes, deprecated and removed features, bug fixes, and known issues, refer to the Release Notes.

Topics%20covered

Topics Covered

security advisory moderate security update red hat security enhancement kubernetes red hat advanced cluster security

References

https://access.redhat.com/security/cve/CVE-2020-24736 https://access.redhat.com/security/cve/CVE-2022-27191 https://access.redhat.com/security/cve/CVE-2022-41723 https://access.redhat.com/security/cve/CVE-2023-1667 https://access.redhat.com/security/cve/CVE-2023-2283 https://access.redhat.com/security/cve/CVE-2023-24329 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-26604 https://access.redhat.com/security/cve/CVE-2023-32067 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.1/html/release_notes/release-notes-41

Package List


Advisory ID: RHSA-2023:3943-01
Product: Red Hat Advanced Cluster Security for Kubernetes
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3943
Issue date: 2023-06-29

Topic

Updated images are now available for Red Hat Advanced Cluster Security(RHACS). The updated image includes new features and bug fixes.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security update red hat security enhancement kubernetes red hat advanced cluster security

Relevant Releases Architectures

Bugs Fixed

2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server

2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding

2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption

2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation

2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing

5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects):

ROX-18018 - Release RHACS 4.1.0

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here