STIG Profiles

1 - Anchore STIG Profiles Release Notes - 2026-11-03

Anchore STIG Profiles - 2026-11-03

The profile-inputs.yaml files for the RHEL 8 and RHEL 9 profiles are corrected. The profiles themselves are unchanged. The update was published through the Anchore Data Service on 2026-11-03. Anchore Enterprise deployments receive it at their next feed sync. Air-gapped deployments receive it when they next download and import the datasets.

The files had outdated values that gave some wrong results. This affected evaluations that used rhel8/profile-inputs.yaml or rhel9/profile-inputs.yaml as an inputs file, for example with --stig-input-file. Evaluations run without an inputs file used the profiles’ built-in defaults, which already have the corrected values, and were not affected.

Corrected Inputs

The corrected non_removable_media_fs and system_activity_timeout values do not change results for container images: no rhel8 control reads system_activity_timeout, and the controls that read non_removable_media_fs are Not Applicable to containers.

rhel8 SV-230337 and SV-256974 and rhel9 SV-258057 appear under both Fixed: Wrong Failures and Fixed: Wrong Passes: with the old values, these checks failed images that met the STIG and passed images that did not.

Fixed: Wrong Failures

• rhel8 SV-256973 looked for a CentOS key file, which RHEL 8 images do not have, so it failed on every RHEL 8 image evaluated with the old rhel8/profile-inputs.yaml. It now checks the Red Hat key file.
• rhel8 SV-230373 and rhel9 SV-258049 failed on images that disable accounts after 35 days of inactivity, as the STIG requires. They now accept up to 35 days.
• rhel8 SV-230337 and rhel9 SV-258057 failed on images that keep accounts locked until an administrator unlocks them (unlock_time = 0), as the STIG requires. They now require that setting.
• rhel8 SV-256974 checked for postfix, so it failed on images without postfix, including images that have the mailx package that the STIG names. It now checks for mailx.
• rhel8 SV-230317 and rhel9 SV-258050 also checked root’s initialization files, which the STIG check does not cover, so they could fail on root’s PATH settings. They now skip root.

Fixed: Wrong Passes

• rhel8 SV-244531 and SV-244532 skipped every user, so they passed without checking anything. They now check the files in users’ home directories.
• rhel8 SV-230553 checked 1 of the 4 X server packages that must not be installed. It now checks all 4.
• rhel8 SV-230337 and rhel9 SV-258057 passed on images that unlock accounts automatically after 7 days (unlock_time = 604800). They now fail there.
• rhel8 SV-256974 passed on images with postfix instead of mailx. It now fails there.

Update and Rescan

• If you pass the shipped profile-inputs.yaml with --stig-input-file, run anchorectl stig write-profiles again after your deployment has synced the update, then rescan RHEL 8 and RHEL 9 images.
• If you keep your own inputs file, check it against the table above.
• To see which commands replace an image’s existing evaluation, see Managing STIG Evaluations.

2 - Anchore STIG Profiles Release Notes - 2026-11-02

Anchore STIG Profiles - 2026-11-02

The Chainguard profile is updated to version 1.1.0. The update was published through the Anchore Data Service on 2026-11-02. Anchore Enterprise deployments receive it at their next feed sync. Air-gapped deployments receive it when they next download and import the datasets.

Updated Profiles

Changes

• The CA bundle check (oval:org.CABundleHash:def:1) also checks the Java truststore (/etc/ssl/certs/java/cacerts) in images that have one. The truststore must match the digest recorded beside it when the Chainguard image was built, so a Java image that runs update-ca-certificates in a layer added on top of a Chainguard image now fails this check. A truststore with no recorded digest beside it also fails.
• The expected_cacert_hash input applies to the system CA bundle only. Setting it does not change the result of the Java truststore check.
• The profile still has 9 controls.

Update and Rescan

• After your deployment has synced the update, run anchorectl stig write-profiles again, then rescan Chainguard images.
• To see which commands replace an image’s existing evaluation, see Managing STIG Evaluations.

3 - Anchore STIG Profiles Release Notes - 2026-10-20

Anchore STIG Profiles - 2026-10-20

rhel8 now implements the DISA RHEL 8 STIG V2R9, and rhel9 the DISA RHEL 9 STIG V2R10. The profiles published before this update implemented V2R7 (rhel8 2.7.0) and V2R4 (rhel9 2.4.0), so this update also includes the changes from the DISA releases in between (RHEL 8 V2R8, RHEL 9 V2R5 to V2R9). The update was published through the Anchore Data Service on 2026-10-20. Anchore Enterprise deployments receive it at their next feed sync. Air-gapped deployments receive it when they next download and import the datasets.

Updated Profiles

Changes

• rhel8 has 371 controls (was 366). Added SV-284947, SV-284948, SV-284949, SV-288829, SV-288830 and SV-288831. Removed SV-230285, which is not in V2R9.
• rhel9 has 445 controls (was 453). Added SV-288832 and SV-288833. Removed 10 controls that are not in V2R10: SV-257829, SV-257836, SV-257987, SV-257988, SV-258002, SV-258062, SV-258076, SV-258172, SV-258226 and SV-258237.
• rhel8 now recognizes Podman and other container runtimes, not only Docker, so controls that do not apply to containers are reported as Not Applicable there too.
• The profile-inputs.yaml files for rhel8, rhel9 and nginx changed. For rhel8, inputs were added, removed or updated for version 2.9.0, for example pass_max_days: 180. For rhel9, inputs that no control reads were removed. If you pass one of these files with --stig-input-file, or keep your own copy, compare it with the new file.

Fixed: Evaluations That Stopped with an Error

• The previous rhel8 and nginx profile-inputs.yaml files set some inputs with the wrong type: rhel8 set root_ca_file as a string instead of a hash, and nginx set 10 true/false inputs as quoted strings. Evaluations run with either file, for example with --stig-input-file, stopped with an error and produced no results. Both files now use the declared types.

Fixed: Wrong Passes and Wrong Not Applicable

• rhel8 SV-230287 and rhel9 SV-258000 looked only for *.pem files, so they did not check the SSH private host key files in /etc/ssh. They now check them against mode 0600, as the STIG now requires (it was 0640). Host key files more permissive than 0600 now fail.
• rhel8 SV-230367 and rhel9 SV-258042 did not compare each user’s maximum password age, so local users without a limit (99999 days) passed. The checks now fail on images that have such users. The STIG now sets the maximum to 180 days (it was 60).
• rhel8 SV-230333, SV-230335, SV-230337, SV-230339, SV-230341, SV-230343, SV-230345, SV-244533 and SV-244534 (account lockout with faillock) were Not Applicable on RHEL 8.2 and later because of a wrong version check. They now apply there.

Other checks also changed with the new STIG releases, so compare your results after you rescan.

Update and Rescan

• After your deployment has synced the update, run anchorectl stig write-profiles again, then rescan RHEL 8 and RHEL 9 images. If you pass nginx/profile-inputs.yaml with --stig-input-file, also rescan NGINX images.
• To see which commands replace an image’s existing evaluation, see Managing STIG Evaluations.
• Images that you do not rescan keep their previous results.