An ACS 4.1 enhancement and security update has been released.

[RHSA-2023:3943-01] Moderate: ACS 4.1 enhancement and security update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: ACS 4.1 enhancement and security update
Advisory ID: RHSA-2023:3943-01
Product: Red Hat Advanced Cluster Security for Kubernetes
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3943
Issue date: 2023-06-29
CVE Names: CVE-2020-24736 CVE-2022-27191 CVE-2022-41723
CVE-2023-1667 CVE-2023-2283 CVE-2023-24329
CVE-2023-24534 CVE-2023-24536 CVE-2023-24537
CVE-2023-24538 CVE-2023-26604 CVE-2023-32067
=====================================================================

1. Summary:

Updated images are now available for Red Hat Advanced Cluster Security
(RHACS). The updated image includes new features and bug fixes.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The release of ACS 4.1 provides these changes:

Security Fix(es):

* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)

* golang: net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)

* golang: net/http, net/textproto, mime/multipart: denial of service from
excessive resource consumption (CVE-2023-24536)

* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

* golang: html/template: backticks not treated as string delimiters
(CVE-2023-24538)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

New features:

* Manual renewal of Central and Sensor certificates

* Vulnerability Management 2.0 (Technology Preview)

* RHACS Cloud Service scanning support for images pulled from on-premise
registries

* eBPF collection method on IBM Z and IBM® LinuxONE

* Ability to configure the display of default compliance standards in the
Compliance Dashboard

* Declarative configurations for authentication and authorization

* SSO configuration using the roxctl CLI

* New collection method based on BPF CO-RE (Technology Preview)

* Network graph updates

* Policy Management simplification

* New permission sets

* Improvements for Sensor resync (General Availability)

For notable technical changes, deprecated and removed features, bug fixes,
and known issues, refer to the Release Notes.

3. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed ( https://bugzilla.redhat.com/):

2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server
2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters
2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing

5. JIRA issues fixed ( https://issues.redhat.com/):

ROX-18018 - Release RHACS 4.1.0

6. References:

https://access.redhat.com/security/cve/CVE-2020-24736
https://access.redhat.com/security/cve/CVE-2022-27191
https://access.redhat.com/security/cve/CVE-2022-41723
https://access.redhat.com/security/cve/CVE-2023-1667
https://access.redhat.com/security/cve/CVE-2023-2283
https://access.redhat.com/security/cve/CVE-2023-24329
https://access.redhat.com/security/cve/CVE-2023-24534
https://access.redhat.com/security/cve/CVE-2023-24536
https://access.redhat.com/security/cve/CVE-2023-24537
https://access.redhat.com/security/cve/CVE-2023-24538
https://access.redhat.com/security/cve/CVE-2023-26604
https://access.redhat.com/security/cve/CVE-2023-32067
https://access.redhat.com/security/updates/classification/#moderate
https://docs.openshift.com/acs/4.1/release_notes/41-release-notes.html

7. Contact:

The Red Hat security contact is [secalert@redhat.com]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.

--