Chapter 4. Known issues

Resolved known issues for this release of Red Hat Trusted Profile Analyzer (RHTPA):

A list of unresolved known issues found in this release:

License information does not comply with SPDX specification standards: The embedded license information within a package or component of a Software Bill of Materials (SBOM) does not comply with the SPDX specification standards. Because of this issue, RHTPA marks the package URL license details as NOASSERTION. Currently, there is no workaround for this issue.

A custom Quay source with self signed certificate does not import data: When you set a custom Quay source with self signed certificate, the data is not import into RHTPA. This is because the trust anchor for data importers is missing. Currently, there is no workaround for this issue.

An IncompleteBody error when using OpenShift Data Foundation: Red Hat’s OpenShift Data Foundation does not support compression logic that uses the aws-sdk Rust client. When using OpenShift Data Foundation as an object store for RHTPA, you can get a 409 response code, along with an IncompleteBody error message. This issue resides within the OpenShift Data Foundation code base. To workaround this issue, we removed the compression logic capability from RHTPA’s source code when using OpenShift Data Foundation. This workaround results in Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) documents uploading without errors.

The rhtpa-operator-controller-manager pod in a reconciliation loop: The rhtpa-operator-controller-manager pod keeps going into a reconciliation loop each time after updating the server or resource. This makes manual changes impossible because it conflicts with the configuration updates automatically done during reconciliation. This also cause the logs to fill up with a line every second for each new reconciliation trigger event. Currently, there is no workaround for this issue.

Large number of vulnerabilities reported: The logic that correlates vulnerability data between advisories and large Software Bill of Materials (SBOM) documents can cause pages to load slowly, and display large number of vulnerabilities. Currently, there is no workaround for this issue.

Searching by SBOM version gives inconsistent results: When using Software Bill of Materials (SBOM) version numbers as search criteria, you can get inconsistent results. In some cases, the search engine can find SBOM version numbers that have the version number in the file name or in the document_id field. In other cases, the search engine finds no matching SBOM versions, even with a valid SBOM version number. There is currently no workaround for this issue.

Remote server connection drops on bulk uploads that use the API: When uploading a compressed SBOM document that uses the RHTPA API, for example, a 350 MB compressed file, the connection to the remote RHTPA service can drop. This causes a partial uploading of the files. To workaround this issue, split the larger SBOM document into smaller sizes, for example, a compressed file roughly 10-20 MB in size. This allows the uploading to finish successfully.

Vulnerability information cannot be deleted by using the API: Using the RHTPA API to delete vulnerabilities and Common Vulnerabilities and Exposures (CVE) information gives a foreign key constraints error message. With this release, we added a Not implemented message in the return code. In a future release, we are going to deprecate this delete function.

No support for CPE version 2.3: The Common Platform Enumeration (CPE) specification and Software Bill of Materials (SBOM) formatted with string bindings does not render properly in the RHTPA console, and when exporting license information. There is currently no workaround for this issue.

Trusted Profile Analyzer 2.0 requires Helm version 3.17 or later: To install RHTPA 2.0 and later, you must use Helm version 3.17 or later to deploy the Trusted Profile Analyzer service on the Red Hat OpenShift Container Platform.

No support for CVSS v4 scores: Currently, there is no support for Common Vulnerability Scoring System (CVSS) version 4 scores in RHTPA.

Advisories with an environment or temporal score fails to upload: A Common Security Advisory Framework (CSAF) document with a Common Vulnerability Scoring System (CVSS) vector that has an environment or temporal score can fail when uploading it to RHTPA. Because of this upload failure, you cannot see the advisory within the RHTPA console. Currently, there is no workaround for this issue.