Team -

We have customers requesting coverage for some CVEs that don't appear to be covered in any of the existing OVAL archives.

Red Hat OpenShift GitOps:

• CVE-2022-24348

Red Hat Advanced Cluster Management 2.4.2:

• CVE-2021-22963
• CVE-2021-43816
• CVE-2022-0235
• CVE-2022-24450

I believe the Advanced Cluster Management 2 would be covered under RHEL8/rhacm-2.oval.xml.bz2, but the contents of this file state it is being intentionally left empty and will be populated once vulnerabilities are known.

I don't see any OVAL archives that look like they would be for Red Hat OpenShift GitOps.

With these CVEs be covered in any OVAL archives or is this something that isn't planned currently? Thanks!