rhsa-2022_8827
Vulnerability from csaf_redhat
Published
2022-12-06 14:00
Modified
2024-12-15 22:03
Summary
Red Hat Security Advisory: RHACS 3.73 enhancement and security update

Notes

Topic
Updated images are now available for Red Hat Advanced Cluster Security (RHACS). The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Release of RHACS 3.73 provides these changes: New features: * Red Hat Advanced Cluster Security Cloud Service (ACSCS) is a Red Hat managed service that simplifies and accelerates RHACS deployments. ACSCS is available as a Field Trial release. For more information about accessing ACSCS, contact Red Hat Sales. * Improved Vulnerability Management dashboard for ACSCS users. * PostgreSQL database option is available as Technology Preview feature. If you are interested in participating in the Tech Preview program, contact your Red Hat account representative. * A new build-time network policy generator as Technology Preview feature, to generate Kubernetes network policies based on Application YAML manifests. Notable technical changes: * RHACS uses GraphQL internally to show data in the RHACS portal. However, Red Hat does not support querying RHACS using GraphQL. If you are using GraphQL, see https://access.redhat.com/articles/6986289 and contact Red Hat Consulting. * Sensor no longer uses `anyuid` Security Context Constraint (SCC). Instead, the default SCC for Sensor is now `restricted[-v2]` or `stackrox-sensor`, depending on the settings. In addition, the `runAsUser` and `fsGroup` for the Admission control and Sensor deployments are no longer hard-coded to `4000` on OpenShift clusters to allow using the `restricted` and `restricted-v2` SCCs. (ROX-9342) * The service account `central`, which the Central deployment uses, now includes `get` and `list` access to the pods, events, and namespaces resources in the namespace where you deploy Central. * The CSV export API `/api/vm/export/csv` now requires the `CVE Type` filter as part of the input query parameter. Supported values for `CVE Type` are `IMAGE_CVE`, `K8S_CVE`, `ISTIO_CVE`, `NODE_CVE`, and `OPENSHIFT_CVE`. Notice of in-product docs removal: * Beginning in the RHACS 3.74 release, Red Hat will remove the in-product docs accessible from the help menu. If you are using the in-product docs, you can instead download the required documentation in PDF format from Red Hat Customer Portal. (ROX-12839) Bug fixes: * Previously, if you were using StackRox Kubernetes Security Platform - Splunk Technology Add-on, results for the `ocp4-cis-node` compliance standard was missing from Splunk. This issue is now fixed. The Splunk integration now includes the `ocp4-cis-node` compliance standard results. (ROX-11937) * Previously, Central would fail on the v1 CronJob deployment check. This issue is fixed. (ROX-13500) Security Fix(es): * imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778) * app-containers/cosign: false positive verification (CVE-2022-36056) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Advanced Cluster Security (RHACS). The updated image includes new features and bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Release of RHACS 3.73 provides these changes:\n\nNew features:\n\n* Red Hat Advanced Cluster Security Cloud Service (ACSCS) is a Red Hat managed service that simplifies and accelerates RHACS deployments. ACSCS is available as a Field Trial release. For more information about accessing ACSCS, contact Red Hat Sales.\n* Improved Vulnerability Management dashboard for ACSCS users.\n* PostgreSQL database option is available as Technology Preview feature. If you are interested in participating in the Tech Preview program, contact your Red Hat account representative.\n* A new build-time network policy generator as Technology Preview feature, to generate Kubernetes network policies based on Application YAML manifests.\n\nNotable technical changes:\n\n* RHACS uses GraphQL internally to show data in the RHACS portal. However, Red Hat does not support querying RHACS using GraphQL. If you are using GraphQL, see https://access.redhat.com/articles/6986289 and contact Red Hat Consulting.\n* Sensor no longer uses `anyuid` Security Context Constraint (SCC). Instead, the default SCC for Sensor is now `restricted[-v2]` or `stackrox-sensor`, depending on the settings. In addition, the `runAsUser` and `fsGroup` for the Admission control and Sensor deployments are no longer hard-coded to `4000` on OpenShift clusters to allow using the `restricted` and `restricted-v2` SCCs. (ROX-9342)\n* The service account `central`, which the Central deployment uses, now includes `get` and `list` access to the pods, events, and namespaces resources in the namespace where you deploy Central.\n* The CSV export API `/api/vm/export/csv` now requires the `CVE Type` filter as part of the input query parameter. Supported values for `CVE Type` are `IMAGE_CVE`, `K8S_CVE`, `ISTIO_CVE`, `NODE_CVE`, and `OPENSHIFT_CVE`.\n\nNotice of in-product docs removal:\n\n* Beginning in the RHACS 3.74 release, Red Hat will remove the in-product docs accessible from the help menu. If you are using the in-product docs, you can instead download the required documentation in PDF format from Red Hat Customer Portal. (ROX-12839)\n\nBug fixes:\n\n* Previously, if you were using StackRox Kubernetes Security Platform - Splunk Technology Add-on, results for the `ocp4-cis-node` compliance standard was missing from Splunk. This issue is now fixed. The Splunk integration now includes the `ocp4-cis-node` compliance standard results. (ROX-11937)\n* Previously, Central would fail on the v1 CronJob deployment check. This issue is fixed. (ROX-13500)\n\nSecurity Fix(es):\n\n* imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path (CVE-2022-24778)\n\n* app-containers/cosign: false positive verification (CVE-2022-36056)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:8827",
        "url": "https://access.redhat.com/errata/RHSA-2022:8827"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/acs/3.73/release_notes/373-release-notes.html",
        "url": "https://docs.openshift.com/acs/3.73/release_notes/373-release-notes.html"
      },
      {
        "category": "external",
        "summary": "2069368",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2069368"
      },
      {
        "category": "external",
        "summary": "2128820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128820"
      },
      {
        "category": "external",
        "summary": "ROX-13687",
        "url": "https://issues.redhat.com/browse/ROX-13687"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8827.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHACS 3.73 enhancement and security update",
    "tracking": {
      "current_release_date": "2024-12-15T22:03:05+00:00",
      "generator": {
        "date": "2024-12-15T22:03:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2022:8827",
      "initial_release_date": "2022-12-06T14:00:32+00:00",
      "revision_history": [
        {
          "date": "2022-12-06T14:00:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-12-06T14:00:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T22:03:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHACS 3.73 for RHEL 8",
                "product": {
                  "name": "RHACS 3.73 for RHEL 8",
                  "product_id": "8Base-RHACS-3.73",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:advanced_cluster_security:3.73::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Cluster Security for Kubernetes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
                  "product_id": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
                  "product_id": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8\u0026tag=3.73.0-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
                  "product_id": "advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-docs-rhel8\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
                  "product_id": "advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
                  "product_id": "advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle\u0026tag=3.73.0-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
                  "product_id": "advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
                  "product_id": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8\u0026tag=3.73.0-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8\u0026tag=3.73.0-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64",
                "product": {
                  "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64",
                  "product_id": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d?arch=amd64\u0026repository_url=registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8\u0026tag=3.73.0-4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64 as a component of RHACS 3.73 for RHEL 8",
          "product_id": "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64"
        },
        "product_reference": "advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64",
        "relates_to_product_reference": "8Base-RHACS-3.73"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-24778",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2022-03-28T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2069368"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the imgcrypt library when checking the keys of an authorized user to access an encrypted image on systems where layers are not available and cannot run on the host architecture. This flaw allows an attacker to run an image without providing the previously decrypted keys.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Only Fedora is using the affected codebase. Hence, marking other products as of Low impact as they are using an affected version of \u0027imgcrypt\u0027 as a transitive dependency.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-24778"
        },
        {
          "category": "external",
          "summary": "RHBZ#2069368",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2069368"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24778",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-24778"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24778",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24778"
        },
        {
          "category": "external",
          "summary": "https://github.com/containerd/imgcrypt/security/advisories/GHSA-8v99-48m9-c8pm",
          "url": "https://github.com/containerd/imgcrypt/security/advisories/GHSA-8v99-48m9-c8pm"
        }
      ],
      "release_date": "2022-03-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-12-06T14:00:32+00:00",
          "details": "To take advantage of the new features, bug fixes, and enhancements in RHACS 3.73 you are advised to upgrade to RHACS 3.73.0.",
          "product_ids": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:8827"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path"
    },
    {
      "cve": "CVE-2022-36056",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2022-09-21T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2128820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in cosign, where it incorrectly verified an artifact when the embedded rekorBundle does not reference the given signature. This flaw allows an attacker to exploit integrity and confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "app-containers/cosign: false positive verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64"
        ],
        "known_not_affected": [
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
          "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-36056"
        },
        {
          "category": "external",
          "summary": "RHBZ#2128820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36056",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-36056"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36056",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36056"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388",
          "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388"
        }
      ],
      "release_date": "2022-09-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-12-06T14:00:32+00:00",
          "details": "To take advantage of the new features, bug fixes, and enhancements in RHACS 3.73 you are advised to upgrade to RHACS 3.73.0.",
          "product_ids": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:8827"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-central-db-rhel8@sha256:83b7562687545ba41fedd5f5d6ed5403fe7a3a5cac3110e711cbe46dad2d26fd_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-rhel8@sha256:cc229c86ecb3d1e1b1af479041fa8e940c61e69dbc309c8e66de7945df5cc591_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:7ad85567fea6d1c1b5ca6a360cb1565184df075bad61ffc8ce5ec0595273e733_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-docs-rhel8@sha256:87bf4d7e041d6e3197b1c23c58061f877434f6e550ddf516b6512be5309f89c3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-main-rhel8@sha256:82d8a9f94f291d6ee6f38668bc13e4830efc5b289754232d6e8a483043771da3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-operator-bundle@sha256:d496a827f223e5464a1b6c87168102df632643e1f8348a8abb1a5e9e226f00d2_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-rhel8-operator@sha256:1ef51b3cd89d4da166d8b9e1582fa7c0fc5415e0eb2f2c8ab18ec704d2bd74d8_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-roxctl-rhel8@sha256:61f027ae531f3e23f2394e7f93c397eda14ce1ad93e8c19d463cd301464147b5_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2dd59fe0134c5d2f239d6f96d6876ac687e0490e52ab41647842e3244623480c_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:38b7030affee05fd8cd8e947b89ff8b40962af45267e2ec0143f827c8e33eca3_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-rhel8@sha256:976ca1e50768c0c619d56b99d0660bf1885164cc3982136821650479946c904d_amd64",
            "8Base-RHACS-3.73:advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:aefb2507e2c8a68ca457c0f208ea2cc24ae52a694c03e2c85ffd172f6673f18d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "app-containers/cosign: false positive verification"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.