This security advisory concerns Red Hat Trusted Artifact Signer (RHTAS) 1.3.4, an OpenShift Operator used with OpenShift Container Platform versions 4.16 to 4.20. It references three CVEs related to this product. RHTAS facilitates cryptographic signing and verification of container images, binaries, and source code changes to enhance software supply chain security. The advisory does not specify any available patches or fixes for these vulnerabilities. There is no indication of known exploits in the wild. The vendor advisory primarily provides product documentation and release notes without explicit remediation instructions.

The vulnerabilities affect the integrity and security of the software supply chain managed by RHTAS. Since RHTAS is used to sign and verify software artifacts, exploitation could potentially undermine trust in software authenticity and integrity. However, the advisory does not detail specific impacts or exploitation scenarios. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory does not list any fixes or patches for these CVEs at this time. Users should monitor Red Hat's official security updates and apply any future patches promptly once available. Refer to the official product documentation and release notes for guidance on secure deployment and usage.