A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a small subset of table cells. The only known potential exploit is if the script is included in the name of a Kubernetes “Role” object that is applied to a secured cluster. This object can be used by a user with access to the cluster or through a compromised third-party product.

The release of ACS 4.1 provides these changes:Security Fix(es): golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191) net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) golang: go/parser: Infinite loop in parsing (CVE-2023-24537) golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.New features: Manual renewal of Central and Sensor certificates Vulnerability Management 2.0 (Technology Preview) RHACS Cloud Service scanning support for images pulled from on-premise registries eBPF collection method on IBM Z and IBM® LinuxONE Ability to configure the display of default compliance standards in the Compliance Dashboard Declarative configurations for authentication and authorization SSO configuration using the roxctl CLI New collection method based on BPF CO-RE (Technology Preview) Network graph updates Policy Management simplification New permission sets Improvements for Sensor resync (General Availability) For notable technical changes, deprecated and removed features, bug fixes, and known issues, refer to the Release Notes.

New features and enhancements<br>1. Verifying image signatures against Cosign public keys: You can use RHACS to ensure the integrity of the container images in your clusters by verifying image signatures against preconfigured keys. You can also create policies to block unsigned images and images that do not have a verified signature and enforce the policy by using an admission controller to stop unauthorized deployment creation. <br>2. Registry integrations for Amazon Elastic Container Registry (ECR) are now automatically generated for Amazon Web Services (AWS) clusters. This feature requires that the nodes' Instance Identity and Access Management (IAM) Role has been granted access to ECR. You can turn off this feature by disabling the EC2 instance metadata service in your nodes. <br>3. Identifying missing Kubernetes network policies: RHACS 3.70 ships with a new default policy that allows you to easily identify deployments that are not restricted by any ingress network policy and to trigger violation alerts accordingly. The default policy is named Deployments should have at least one ingress Network Policy. It is disabled by default. This default policy uses a new policy criterion called "Alert on missing ingress Network Policy." To identify pod isolation gaps, you can clone this default policy or create a new one by using the policy criterion and enabling it on selected resources.<br>4. A policy to detect the Spring Cloud Function RCE vulnerability [CVE-2022-22963] and the Spring Framework Spring4Shell RCE vulnerability [CVE-2022-22965] has been added. It has a severity level of Critical and is enabled by default.<br>5. A new policy criterion has been added to validate the value of allowPrivilegeEscalation within the Kubernetes security context. You can use this policy criterion to provide alerts when a deployment is configured to allow a container process to gain more privileges than its parent process.<br>6. Customers using the recommended Operator method to deploy RHACS on OpenShift Container Platform can now view the credentials for the admin user in the OpenShift Container Platform console. When viewing the Central object, the Details tab provides a clickable link to the credentials under Admin Password Secret Reference. The displayed credentials are the default generated password or a previously configured and stored custom secret.<br>7. Previously, RHACS limited the number of allowed inclusion and exclusion scopes within a scope to ten each. This restriction has been removed.<br>Notable technical changes<br>1. Vulnerability scanning and reporting for RHCOS nodes: Vulnerability scanning and reporting for Red Hat Enterprise Linux CoreOS (RHCOS) nodes has been disabled until scanning improvements are made for improved accuracy and to support full host-level scanning beyond just Kubernetes components. Currently, RHCOS uses National Vulnerability Database (NVD) vulnerability data for reporting vulnerabilities for Kubernetes components from RHCOS. In the enhanced version, vulnerability reporting will be based on Red Hat published security data. (ROX-10662)<br>Deprecated Features:<br><li> Ability to add comments to alerts and processes</li> <li> Anchore, Tenable, and Docker Trusted registry integrations</li> <li> External authorization plug-in for scoped access control</li> <li> FROM option in the Disallowed Dockerfile line policy field</li> <li> RenamePolicyCategory and DeletePolicyCategory API endpoints</li> <li> --rhacs option for the roxctl helm output command</li> Removed Features:<br><li> Ability to delete default policies</li> <li> Security policies without a policyVersion</li> <li> /v1/policies API endpoint response: field response body parameter</li> Security Fixes:<br><li> json-pointer: type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays (CVE-2021-23820)</li> <li> opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)</li>