Release Notes
Red Hat Trusted Profile Analyzer 3.1
Release notes for Red Hat Trusted Profile Analyzer 3.1
Abstract
Welcome to Red Hat Trusted Profile Analyzer's official release notes for version 3.1!
The release notes describes new features, enhancements, known issues, bug fixes, and deprecation implemented for the Red Hat Trusted Profile Analyzer 3.1 software release.
Preface
Red Hat Trusted Profile Analyzer (RHTPA) version 3.1 release notes include enhancements, bug fixes, known issues, and deprecated functionality.
Chapter 1. Introduction
Red Hat Trusted Profile Analyzer (RHTPA) is a proactive service that assists in risk management of Open Source Software (OSS) packages and dependencies. The Trusted Profile Analyzer service brings awareness to and remediation of OSS vulnerabilities discovered within the software supply chain.
The Trusted Profile Analyzer software Release Notes documents new features and enhancements, bug fixes, and known issues for the latest version, 3.1. We add the newest items to the top in each chapter, as we build upon the official release notes over the lifecycle of the major, and minor releases.
- New for this release
- Exploit Intelligence is now generally available (GA), enabling exploitability analysis using SBOM files or repository URLs to generate exploitability reports and VEX documents.
Additional resources
Chapter 2. New features and enhancements
A list of all major enhancements, and new features introduced in this release of Red Hat Trusted Profile Analyzer (RHTPA).
The features and enhancements added by this release are:
- Exploit Intelligence is now generally available
- With this update, the Exploit Intelligence feature is now generally available (GA). You can submit analysis requests by using Software Bill of Materials (SBOM) files or direct repository URLs and review the generated exploitability reports and Vulnerability Exploitability eXchange (VEX) documents. This feature helps you assess the exploitability of vulnerabilities in your software and prioritize remediation efforts.
Additional resources
- Content from github.com is not included.Trustify API Changes: 0.4 → 0.5. Version 0.4 corresponds to RHTPA 2.2.6; version 0.5 corresponds to RHTPA 3.0.
Chapter 3. Bug fixes
In this release of Red Hat Trusted Profile Analyzer (RHTPA), we fixed the following bugs.
- RHTPA incorrectly propagates package properties in SPDX SBOMs
- Red Hat Trusted Profile Analyzer (RHTPA) misinterpreted the DESCRIBES and DESCRIBED BY relationship properties in SPDX Software Bill of Materials (SBOM) documents by reversing the inner and outer element relationships. Consequently, main package properties, such as supplier and creator, were not propagated to the SBOM level and were missing from API responses and the user interface. This issue has been fixed.
Chapter 4. Known issues
A list of unresolved known issues found in this release:
- Report analysis fails for RPM packages with .hum1 suffix
-
When you scan an RPM package with the
.hum1filename suffix (for example,mariadb-connector-c-3.4.9-1.hum1), the system generates a report with aFailedstatus. Currently, Exploit Intelligence does not support RPM packages with the.hum1filename suffix. There is no workaround for this issue at this time.
- Exploit Intelligence Operator cannot be used for RHTPA integration
- The Exploit Intelligence Operator supports only OAuth-based OpenID Connect (OIDC) providers. However, RHTPA does not support OAuth authentication for the Exploit Intelligence integration. As a workaround, use the Exploit Intelligence kustomize-based deployment with a Keycloak or Cognito OIDC provider instead of the Operator.
- Trustify fails to match advisories for container images identified by SHA256 digests
- Trustify misinterprets container image digests (sha256:…) as sequential version numbers rather than unordered fingerprints, and attempts to store them in version ranges. Consequently, range conditions are never met, vulnerability analysis returns empty results for affected OCI packages, and Exploit Intelligence analysis fails for SPDX SBOM files. There is currently no workaround for this issue.
- Trustify does not evaluate version schemes and range bounds when resolving advisories
- Trustify does not evaluate advisory version schemes and range bounds when resolving product vulnerability statuses for a package URL. Consequently, non-applicable version ranges are returned, and packages past their fix version are still reported as affected. There is currently no workaround for this issue.
- Trustify does not apply CPE context filtering to CSAF advisories
- The product vulnerability statuses for a package URL are derived without considering a CSAF advisory’s CPE context. Consequently, advisory statuses tied to one product are applied to packages from other products. As a result, Trustify reports irrelevant RPM version ranges and reports large volumes of false-positive vulnerability rows when analyzing full SBOMs. There is currently no workaround for this issue.
Legal Notice
Copyright © Red Hat.
Except as otherwise noted below, the text of and illustrations in this documentation are licensed by Red Hat under the Creative Commons Attribution–Share Alike 3.0 Unported license . If you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, the Red Hat logo, JBoss, Hibernate, and RHCE are trademarks or registered trademarks of Red Hat, LLC. or its subsidiaries in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
XFS is a trademark or registered trademark of Hewlett Packard Enterprise Development LP or its subsidiaries in the United States and other countries.
The OpenStack® Word Mark and OpenStack logo are trademarks or registered trademarks of the Linux Foundation, used under license.
All other trademarks are the property of their respective owners.