Kubernetes Visibility Agent Informer Images: Vulnerability Remediation and Patch Release Schedule Summary The KVA informer image includes third-party packages, and new vulnerabilities in these packages are disclosed continually. As a result, image scans can report new findings even when the deployed informer image has not changed. ServiceNow regularly reviews these findings and provides validated fixes according to the remediation timeframes below. Release schedule ServiceNow reviews security findings for KVA Informer and publishes patch releases as required to address security vulnerabilities within the applicable remediation timeframes. Patch releases are generally published on the last working day of the month when security fixes are due. No patch release is issued in months when no fixes are due. Each patch release includes security fixes and, where appropriate, defect fixes that can be safely incorporated. Patch releases do not introduce new features and do not require an upgrade to the KVA Store application. For the latest available version and release information, refer to the KB1564347 - Helm Chart and Kubernetes YAML file releases Remediation timeframes PriorityFixed withinUrgentAs soon as a validated fix is availableCritical30 daysHigh90 daysMedium180 daysLow365 days Priority is assessed against how the informer actually runs, so it may differ from the severity your own image scanner reports. High, Medium and Low fixes ship in the next monthly patch release. Critical and Urgent fixes ship out of band if the next monthly release falls outside the remediation window. Getting the fix Each patch release is published as a new informer image tag and a matching Helm chart version. Upgrade the informer using your existing Helm or YAML deployment method. The informer and the store application are versioned separately. Each informer release states the minimum store application version it requires, so you do not need to match version numbers exactly. For the latest informer release version, release date, compatibility information, and deployment files, see KB1564347 - Helm Chart and Kubernetes YAML file releases Found a vulnerability in your scan? Check your informer version against the latest available release first. Most vulnerabilities reported by customer scans are already fixed in a later image. Compare your deployed informer version with the latest release.If a newer release is available, upgrade and rescan.If the latest release is still affected, raise a case with ServiceNow Support with the image tag, CVE identifier, and the affected package name and version. Reporting a vulnerability Raise a case with ServiceNow Support with the image tag, CVE identifier, and the affected package name and version.