Red Hat Summit이 콘텐츠는 선택한 언어로 제공되지 않습니다.
Chapter 3. Bug fixes
In this release of Red Hat Trusted Profile Analyzer (RHTPA), we fixed the following bugs. In addition to these fixes, we list the descriptions of previously known issues found in earlier versions that we fixed.
Fixed an inconsistency when a CVE has many CVSS scores
Before this update, vulnerabilities with many Common Vulnerability Scoring System (CVSS) scores were inconsistently displayed when applying a filter. This was happening because the first CVSS score ordered the initial list of vulnerabilities, but the second score reordered the same list when applying a filter giving an inconsistent list of vulnerabilities. With this release, we fixed this order inconsistency by always applying the highest score when ordering the list of vulnerabilities, even when applying a filter. This gives consistency to the vulnerabilities list.
Changed the strategy type for deploying the spog-api and the collectorist-api in OpenShift
Before this update, the default strategy type for deploying the spog-api and the collectorist-api in OpenShift was a rolling strategy. Using the rolling strategy when deploying these 2 APIs mounts a volume with a ReadWriteOnce policy. This causes the pods to fail when redeploying the RHTPA application, because the rolling strategy does not scale down, and the volume is in use by the existing pods. With this release, we changed the default strategy from rolling to recreate for the spog-api and the collectorist-api pods.
Vulnerability count mismatch
Before this update, there is a vulnerability count mismatch between the Common Vulnerability and Exposures (CVE) panel and the Software Bill of Materials (SBOM) dashboard. With this release, we fixed the vulnerability count mismatch between the CVE panel and the SBOM dashboard.
Duplicate SBOMs displayed in the RHTPA console
We fixed a bug when retrieving data from the Graph for Understanding Artifact Composition (GUAC) engine by implementing a proper identification for packages that use a hash within software bill of materials (SBOM) documents. This fix eliminates the showing of any duplicate SBOMs when referring to the same SBOM.
Errors with cyclical dependencies within SBOM documents
Some software bill of materials (SBOM) documents contain cyclical dependencies for packages, which was causing errors with the expected data. We fixed a bug with the Graph for Understanding Artifact Composition (GUAC) engine, so the graph is properly traversed from a package to the product it belongs to. With this update, the package details page reports the correct product association.
SBOM data does not load properly when uploading a large SBOM
Before this update, when uploading a large software bill of materials (SBOM) documents, for example an SBOM that includes 50,000 packages, the RHTPA dashboard does not load properly. With this release, we fixed an issue with Keycloak’s access token expiring before the SBOM can finish uploading its data. Uploading large SBOM document work as expected and display properly in the RHTPA dashboard.
