Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-35653
Vulnerability from cvelistv5
Published
2021-01-12 08:02
Modified
2024-08-04 17:09
Severity ?
EPSS score ?
Summary
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:09:14.596Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "FEDORA-2021-a8ddc1ce70",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"
},
{
"name": "FEDORA-2021-880aa7bd27",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"
},
{
"name": "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-22T12:06:13",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "FEDORA-2021-a8ddc1ce70",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"
},
{
"name": "FEDORA-2021-880aa7bd27",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"
},
{
"name": "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-35653",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
"refsource": "MISC",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "FEDORA-2021-a8ddc1ce70",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"
},
{
"name": "FEDORA-2021-880aa7bd27",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"
},
{
"name": "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-35653",
"datePublished": "2021-01-12T08:02:35",
"dateReserved": "2020-12-23T00:00:00",
"dateUpdated": "2024-08-04T17:09:14.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-35653\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2021-01-12T09:15:13.870\",\"lastModified\":\"2024-11-21T05:27:46.010\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.\"},{\"lang\":\"es\",\"value\":\"En Pillow versiones anteriores a 8.1.0, la funci\u00f3n PcxDecode presenta una lectura excesiva del b\u00fafer cuando se decodifica un archivo PCX dise\u00f1ado porque el valor de paso suministrado por el usuario es confiable para los c\u00e1lculos del b\u00fafer\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:P\",\"baseScore\":5.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.1.0\",\"matchCriteriaId\":\"DFEF53BA-9372-468F-9B1E-6F9C5FF526A9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}],\"references\":[{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://pillow.readthedocs.io/en/stable/releasenotes/index.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://pillow.readthedocs.io/en/stable/releasenotes/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]}]}}"
}
}
pysec-2021-69
Vulnerability from pysec
Published
2021-01-12 09:15
Modified
2021-01-29 00:47
Details
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pillow",
"purl": "pkg:pypi/pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0",
"1.1",
"1.2",
"1.3",
"1.4",
"1.5",
"1.6",
"1.7.0",
"1.7.1",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"2.0.0",
"2.1.0",
"2.2.0",
"2.2.1",
"2.2.2",
"2.3.0",
"2.3.1",
"2.3.2",
"2.4.0",
"2.5.0",
"2.5.1",
"2.5.2",
"2.5.3",
"2.6.0",
"2.6.1",
"2.6.2",
"2.7.0",
"2.8.0",
"2.8.1",
"2.8.2",
"2.9.0",
"3.0.0",
"3.1.0rc1",
"3.1.0.rc1",
"3.1.0",
"3.1.1",
"3.1.2",
"3.2.0",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.3",
"3.4.0",
"3.4.1",
"3.4.2",
"4.0.0",
"4.1.0",
"4.1.1",
"4.2.0",
"4.2.1",
"4.3.0",
"5.0.0",
"5.1.0",
"5.2.0",
"5.3.0",
"5.4.0.dev0",
"5.4.0",
"5.4.1",
"6.0.0",
"6.1.0",
"6.2.0",
"6.2.1",
"6.2.2",
"7.0.0",
"7.1.0",
"7.1.1",
"7.1.2",
"7.2.0",
"8.0.0",
"8.0.1"
]
}
],
"aliases": [
"CVE-2020-35653",
"GHSA-f5g8-5qq7-938w"
],
"details": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
"id": "PYSEC-2021-69",
"modified": "2021-01-29T00:47:00Z",
"published": "2021-01-12T09:15:00Z",
"references": [
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f5g8-5qq7-938w"
}
]
}
wid-sec-w-2022-1835
Vulnerability from csaf_certbund
Published
2021-11-09 23:00
Modified
2024-06-13 22:00
Summary
Red Hat Enterprise Linux (python-pillow): Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in python-pillow ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.
Betroffene Betriebssysteme
- Linux
- UNIX
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in python-pillow ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren und vertrauliche Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-1835 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-1835.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-1835 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1835"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2021-11-09",
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2021:4702 vom 2021-11-16",
"url": "https://access.redhat.com/errata/RHSA-2021:4702"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-5227-1 vom 2022-01-17",
"url": "https://packetstormsecurity.com/files/165588/USN-5227-2.txt"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-5227-3 vom 2022-10-24",
"url": "https://ubuntu.com/security/notices/USN-5227-3"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2-2023-2083 vom 2023-06-08",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2083.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2023-2087 vom 2023-06-13",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2087.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2-2023-2105 vom 2023-07-01",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2105.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1607-1 vom 2024-05-11",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/G2ZGHJ52ROAMO32KNZTUOETPD6QKSIDY/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1673-2 vom 2024-06-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018714.html"
}
],
"source_lang": "en-US",
"title": "Red Hat Enterprise Linux (python-pillow): Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-06-13T22:00:00.000+00:00",
"generator": {
"date": "2024-06-14T08:09:18.280+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.0"
}
},
"id": "WID-SEC-W-2022-1835",
"initial_release_date": "2021-11-09T23:00:00.000+00:00",
"revision_history": [
{
"date": "2021-11-09T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2021-11-10T23:00:00.000+00:00",
"number": "2",
"summary": "Anpassung"
},
{
"date": "2021-11-16T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2022-01-17T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2022-10-24T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2023-06-08T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2023-06-12T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2023-07-02T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2024-05-12T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-06-13T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von SUSE aufgenommen"
}
],
"status": "final",
"version": "10"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "Pillow",
"product": {
"name": "Open Source Python Pillow",
"product_id": "T020996",
"product_identification_helper": {
"cpe": "cpe:/a:python:python:pillow"
}
}
}
],
"category": "product_name",
"name": "Python"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "8",
"product": {
"name": "Red Hat Enterprise Linux 8",
"product_id": "T014111",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:8"
}
}
}
],
"category": "product_name",
"name": "Enterprise Linux"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-35653",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2020-35653"
},
{
"cve": "CVE-2020-35655",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2020-35655"
},
{
"cve": "CVE-2021-25287",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25287"
},
{
"cve": "CVE-2021-25288",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25288"
},
{
"cve": "CVE-2021-25290",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25290"
},
{
"cve": "CVE-2021-25292",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25292"
},
{
"cve": "CVE-2021-25293",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25293"
},
{
"cve": "CVE-2021-27921",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-27921"
},
{
"cve": "CVE-2021-27922",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-27922"
},
{
"cve": "CVE-2021-27923",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-27923"
},
{
"cve": "CVE-2021-28675",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28675"
},
{
"cve": "CVE-2021-28676",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28676"
},
{
"cve": "CVE-2021-28677",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28677"
},
{
"cve": "CVE-2021-28678",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28678"
},
{
"cve": "CVE-2021-34552",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-34552"
}
]
}
WID-SEC-W-2022-1835
Vulnerability from csaf_certbund
Published
2021-11-09 23:00
Modified
2024-06-13 22:00
Summary
Red Hat Enterprise Linux (python-pillow): Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in python-pillow ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.
Betroffene Betriebssysteme
- Linux
- UNIX
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in python-pillow ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren und vertrauliche Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-1835 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-1835.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-1835 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1835"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2021-11-09",
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2021:4702 vom 2021-11-16",
"url": "https://access.redhat.com/errata/RHSA-2021:4702"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-5227-1 vom 2022-01-17",
"url": "https://packetstormsecurity.com/files/165588/USN-5227-2.txt"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-5227-3 vom 2022-10-24",
"url": "https://ubuntu.com/security/notices/USN-5227-3"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2-2023-2083 vom 2023-06-08",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2083.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2023-2087 vom 2023-06-13",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2087.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2-2023-2105 vom 2023-07-01",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2105.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1607-1 vom 2024-05-11",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/G2ZGHJ52ROAMO32KNZTUOETPD6QKSIDY/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1673-2 vom 2024-06-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018714.html"
}
],
"source_lang": "en-US",
"title": "Red Hat Enterprise Linux (python-pillow): Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-06-13T22:00:00.000+00:00",
"generator": {
"date": "2024-06-14T08:09:18.280+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.0"
}
},
"id": "WID-SEC-W-2022-1835",
"initial_release_date": "2021-11-09T23:00:00.000+00:00",
"revision_history": [
{
"date": "2021-11-09T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2021-11-10T23:00:00.000+00:00",
"number": "2",
"summary": "Anpassung"
},
{
"date": "2021-11-16T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2022-01-17T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2022-10-24T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2023-06-08T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2023-06-12T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2023-07-02T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2024-05-12T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-06-13T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von SUSE aufgenommen"
}
],
"status": "final",
"version": "10"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "Pillow",
"product": {
"name": "Open Source Python Pillow",
"product_id": "T020996",
"product_identification_helper": {
"cpe": "cpe:/a:python:python:pillow"
}
}
}
],
"category": "product_name",
"name": "Python"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "8",
"product": {
"name": "Red Hat Enterprise Linux 8",
"product_id": "T014111",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:8"
}
}
}
],
"category": "product_name",
"name": "Enterprise Linux"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-35653",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2020-35653"
},
{
"cve": "CVE-2020-35655",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2020-35655"
},
{
"cve": "CVE-2021-25287",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25287"
},
{
"cve": "CVE-2021-25288",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25288"
},
{
"cve": "CVE-2021-25290",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25290"
},
{
"cve": "CVE-2021-25292",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25292"
},
{
"cve": "CVE-2021-25293",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-25293"
},
{
"cve": "CVE-2021-27921",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-27921"
},
{
"cve": "CVE-2021-27922",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-27922"
},
{
"cve": "CVE-2021-27923",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-27923"
},
{
"cve": "CVE-2021-28675",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28675"
},
{
"cve": "CVE-2021-28676",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28676"
},
{
"cve": "CVE-2021-28677",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28677"
},
{
"cve": "CVE-2021-28678",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-28678"
},
{
"cve": "CVE-2021-34552",
"notes": [
{
"category": "description",
"text": "In Red Hat Enterprise Linux existieren mehrere Schwachstellen. Die Fehler bestehen in der Komponente Python Pillow aufgrund mehrerer Out-of-Bounds-Reads, eines negativen Offsets, eines Fehlers bei regul\u00e4ren Ausdr\u00fccken, mehrerer \u00fcberm\u00e4\u00dfiger Speicherzuweisungen, einer Endlosschleife, \u00fcberm\u00e4\u00dfiger CPU-Auslastung, \u00fcberm\u00e4\u00dfiger Schleifenbildung, eines Puffer\u00fcberlaufs und mehrerer Puffer-Over-Reads. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T002207",
"T000126",
"T020996",
"398363",
"T014111"
]
},
"release_date": "2021-11-09T23:00:00Z",
"title": "CVE-2021-34552"
}
]
}
gsd-2020-35653
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-35653",
"description": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
"id": "GSD-2020-35653",
"references": [
"https://www.suse.com/security/cve/CVE-2020-35653.html",
"https://access.redhat.com/errata/RHSA-2021:4149",
"https://access.redhat.com/errata/RHSA-2021:3917",
"https://ubuntu.com/security/CVE-2020-35653",
"https://security.archlinux.org/CVE-2020-35653"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-35653"
],
"details": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
"id": "GSD-2020-35653",
"modified": "2023-12-13T01:22:00.915792Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-35653",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
"refsource": "MISC",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "FEDORA-2021-a8ddc1ce70",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"
},
{
"name": "FEDORA-2021-880aa7bd27",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"
},
{
"name": "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c8.1.0",
"affected_versions": "All versions before 8.1.0",
"cvss_v2": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-125",
"CWE-937"
],
"date": "2021-07-22",
"description": "In Pillow, `PcxDecode` has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
"fixed_versions": [
"8.1.0"
],
"identifier": "CVE-2020-35653",
"identifiers": [
"CVE-2020-35653"
],
"not_impacted": "All versions starting from 8.1.0",
"package_slug": "pypi/Pillow",
"pubdate": "2021-01-12",
"solution": "Upgrade to version 8.1.0 or above.",
"title": "Out-of-bounds Read",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-35653"
],
"uuid": "5daa388a-c0b4-4958-aee3-d528bb50c7d3"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "8.1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-35653"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html",
"refsource": "MISC",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
},
{
"name": "FEDORA-2021-880aa7bd27",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/"
},
{
"name": "FEDORA-2021-a8ddc1ce70",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/"
},
{
"name": "[debian-lts-announce] 20210722 [SECURITY] [DLA 2716-1] pillow security update",
"refsource": "MLIST",
"tags": [
"Mailing List"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2
}
},
"lastModifiedDate": "2022-04-22T18:54Z",
"publishedDate": "2021-01-12T09:15Z"
}
}
}
rhsa-2021_4149
Vulnerability from csaf_redhat
Published
2021-11-09 17:42
Modified
2024-11-13 23:33
Summary
Red Hat Security Advisory: python-pillow security update
Notes
Topic
An update for python-pillow is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.
Security Fix(es):
* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)
* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)
* python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)
* python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)
* python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)
* python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)
* python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)
* python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)
* python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)
* python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)
* python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)
* python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)
* python-pillow: Buffer overflow in image convert function (CVE-2021-34552)
* python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)
* python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-pillow is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.\n\nSecurity Fix(es):\n\n* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)\n\n* python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)\n\n* python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)\n\n* python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)\n\n* python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)\n\n* python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)\n\n* python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)\n\n* python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)\n\n* python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)\n\n* python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)\n\n* python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)\n\n* python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)\n\n* python-pillow: Buffer overflow in image convert function (CVE-2021-34552)\n\n* python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)\n\n* python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:4149",
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/"
},
{
"category": "external",
"summary": "1915420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915420"
},
{
"category": "external",
"summary": "1915432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915432"
},
{
"category": "external",
"summary": "1934685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934685"
},
{
"category": "external",
"summary": "1934699",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934699"
},
{
"category": "external",
"summary": "1934705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934705"
},
{
"category": "external",
"summary": "1935384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935384"
},
{
"category": "external",
"summary": "1935396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935396"
},
{
"category": "external",
"summary": "1935401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935401"
},
{
"category": "external",
"summary": "1958226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958226"
},
{
"category": "external",
"summary": "1958231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958231"
},
{
"category": "external",
"summary": "1958240",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958240"
},
{
"category": "external",
"summary": "1958252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958252"
},
{
"category": "external",
"summary": "1958257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958257"
},
{
"category": "external",
"summary": "1958263",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958263"
},
{
"category": "external",
"summary": "1982378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982378"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4149.json"
}
],
"title": "Red Hat Security Advisory: python-pillow security update",
"tracking": {
"current_release_date": "2024-11-13T23:33:33+00:00",
"generator": {
"date": "2024-11-13T23:33:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2021:4149",
"initial_release_date": "2021-11-09T17:42:23+00:00",
"revision_history": [
{
"date": "2021-11-09T17:42:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-11-09T17:42:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-13T23:33:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python-pillow-0:5.1.1-16.el8.src",
"product": {
"name": "python-pillow-0:5.1.1-16.el8.src",
"product_id": "python-pillow-0:5.1.1-16.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@5.1.1-16.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-16.el8.aarch64",
"product": {
"name": "python3-pillow-0:5.1.1-16.el8.aarch64",
"product_id": "python3-pillow-0:5.1.1-16.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"product_id": "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"product_id": "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-16.el8.ppc64le",
"product": {
"name": "python3-pillow-0:5.1.1-16.el8.ppc64le",
"product_id": "python3-pillow-0:5.1.1-16.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"product_id": "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"product_id": "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"product_id": "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-16.el8.x86_64",
"product": {
"name": "python3-pillow-0:5.1.1-16.el8.x86_64",
"product_id": "python3-pillow-0:5.1.1-16.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"product_id": "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"product_id": "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-16.el8.s390x",
"product": {
"name": "python3-pillow-0:5.1.1-16.el8.s390x",
"product_id": "python3-pillow-0:5.1.1-16.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-16.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"product_id": "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-16.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"product_id": "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-16.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"product_id": "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-16.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-16.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:5.1.1-16.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src"
},
"product_reference": "python-pillow-0:5.1.1-16.el8.src",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64"
},
"product_reference": "python3-pillow-0:5.1.1-16.el8.aarch64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le"
},
"product_reference": "python3-pillow-0:5.1.1-16.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x"
},
"product_reference": "python3-pillow-0:5.1.1-16.el8.s390x",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64"
},
"product_reference": "python3-pillow-0:5.1.1-16.el8.x86_64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"relates_to_product_reference": "AppStream-8.5.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64",
"relates_to_product_reference": "AppStream-8.5.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-35653",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-01-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1915420"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. The PcxDecode in Pillow has a buffer over-read when decoding a crafted PCX file due to the user-supplied stride value trusted for buffer calculations. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Buffer over-read in PCX image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-35653"
},
{
"category": "external",
"summary": "RHBZ#1915420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915420"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-35653",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35653"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35653",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35653"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security"
}
],
"release_date": "2021-01-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "python-pillow: Buffer over-read in PCX image reader"
},
{
"cve": "CVE-2020-35655",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-01-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1915432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Buffer over-read in SGI RLE image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-35655"
},
{
"category": "external",
"summary": "RHBZ#1915432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-35655",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35655"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35655",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35655"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security"
}
],
"release_date": "2021-01-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "python-pillow: Buffer over-read in SGI RLE image reader"
},
{
"cve": "CVE-2021-25287",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1958226"
}
],
"notes": [
{
"category": "description",
"text": "There is an out-of-bounds read in J2kDecode in j2ku_graya_la. For J2k images with multiple bands, it\u2019s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Out-of-bounds read in J2K image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25287"
},
{
"category": "external",
"summary": "RHBZ#1958226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25287",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25287"
}
],
"release_date": "2021-04-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled as it is by default.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Out-of-bounds read in J2K image reader"
},
{
"cve": "CVE-2021-25288",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1958231"
}
],
"notes": [
{
"category": "description",
"text": "There is an out-of-bounds read in J2kDecode in j2ku_gray_i. For J2k images with multiple bands, it\u2019s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Out-of-bounds read in J2K image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25288"
},
{
"category": "external",
"summary": "RHBZ#1958231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958231"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25288",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25288"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25288",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25288"
}
],
"release_date": "2021-04-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Out-of-bounds read in J2K image reader"
},
{
"cve": "CVE-2021-25290",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. In TiffDecode.c, there is a negative-offset memcpy with an invalid size which could lead to a system crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Negative-offset memcpy in TIFF image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25290"
},
{
"category": "external",
"summary": "RHBZ#1934685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25290",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25290"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25290",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25290"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Negative-offset memcpy in TIFF image reader"
},
{
"cve": "CVE-2021-25292",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934699"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Regular expression DoS in PDF format parser",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25292"
},
{
"category": "external",
"summary": "RHBZ#1934699",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934699"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25292",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25292"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Regular expression DoS in PDF format parser"
},
{
"cve": "CVE-2021-25293",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934705"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. There is an Out of Bounds Read in SGIRleDecode.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Out-of-bounds read in SGI RLE image reader",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25293"
},
{
"category": "external",
"summary": "RHBZ#1934705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934705"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25293"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25293",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25293"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Out-of-bounds read in SGI RLE image reader"
},
{
"cve": "CVE-2021-27921",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1935384"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive memory allocation in BLP image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27921"
},
{
"category": "external",
"summary": "RHBZ#1935384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935384"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27921",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27921"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27921",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27921"
}
],
"release_date": "2021-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive memory allocation in BLP image reader"
},
{
"cve": "CVE-2021-27922",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1935396"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive memory allocation in ICNS image reader",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27922"
},
{
"category": "external",
"summary": "RHBZ#1935396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935396"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27922",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27922"
}
],
"release_date": "2021-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive memory allocation in ICNS image reader"
},
{
"cve": "CVE-2021-27923",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1935401"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive memory allocation in ICO image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27923"
},
{
"category": "external",
"summary": "RHBZ#1935401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935401"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27923",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27923"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27923",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27923"
}
],
"release_date": "2021-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive memory allocation in ICO image reader"
},
{
"cve": "CVE-2021-28675",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1958240"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. PsdImagePlugin.PsdImageFile does not sanity check the number of input layers with regard to the size of the data block which could lead to a denial-of-service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive memory allocation in PSD image reader",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-28675"
},
{
"category": "external",
"summary": "RHBZ#1958240",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958240"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-28675",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28675"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28675",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28675"
}
],
"release_date": "2021-04-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive memory allocation in PSD image reader"
},
{
"cve": "CVE-2021-28676",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2021-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1958252"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. FliDecode.c did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. This issue dates to the PIL fork. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Infinite loop in FLI image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-28676"
},
{
"category": "external",
"summary": "RHBZ#1958252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958252"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-28676",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28676"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security"
}
],
"release_date": "2021-04-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "To mitigate this feature on Red Hat Quay, keep the invoice generation feature disabled, as it is by default.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Infinite loop in FLI image reader"
},
{
"cve": "CVE-2021-28677",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1958257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. The readline used in EPS has to deal with any combination of \\r and \\n as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a denial-of-service of Pillow in the open phase, before an image was accepted for opening.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive CPU use in EPS image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-28677"
},
{
"category": "external",
"summary": "RHBZ#1958257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-28677",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28677"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28677",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28677"
}
],
"release_date": "2021-04-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive CPU use in EPS image reader"
},
{
"cve": "CVE-2021-28678",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-04-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1958263"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. BlpImagePlugin did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive looping in BLP image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-28678"
},
{
"category": "external",
"summary": "RHBZ#1958263",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1958263"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-28678",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28678"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28678",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28678"
}
],
"release_date": "2021-04-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled, as it is by default.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive looping in BLP image reader"
},
{
"cve": "CVE-2021-34552",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2021-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1982378"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. This flaw allows an attacker to pass controlled parameters directly into a convert function, triggering a buffer overflow in the \"convert()\" or \"ImagingConvertTransparent()\" functions in Convert.c. The highest threat to this vulnerability is to system availability.\r\n\r\nIn Red Hat Quay, a vulnerable version of python-pillow is shipped with quay-registry-container, however the invoice generation feature which uses python-pillow is disabled by default. Therefore impact has been rated Moderate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Buffer overflow in image convert function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Due to the compiler options used, the buffer overflow is detected and the impact is lowered to a crash only. Additionally, the \"mode\" parameter has to be attacker controlled, which is considered a rare case.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-34552"
},
{
"category": "external",
"summary": "RHBZ#1982378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982378"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-34552",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-34552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34552"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow"
}
],
"release_date": "2021-07-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-11-09T17:42:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4149"
},
{
"category": "workaround",
"details": "To mitigate this flaw on Red Hat Quay, keep the invoice generation feature disabled, as it is by default.\n\nRed Hat Satellite 6.9 customers can apply following hotfix to eliminate the vulnerability warnings.\n* Download python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm from https://bugzilla.redhat.com/attachment.cgi?id=1819471\n* Stop services:\n# satellite-maintain service stop\n* Upgrade python2-daemon and remove affected package\n# rpm -Uvh python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm\n# yum remove python-pillow\n* Restart services:\n# satellite-maintain service start\n\nSatellite 6.10 future release is also fixing this.",
"product_ids": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.5.0.GA:python-pillow-0:5.1.1-16.el8.src",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python-pillow-debugsource-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-debuginfo-0:5.1.1-16.el8.x86_64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.aarch64",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.ppc64le",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.s390x",
"AppStream-8.5.0.GA:python3-pillow-tk-debuginfo-0:5.1.1-16.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Buffer overflow in image convert function"
}
]
}
rhsa-2021_3917
Vulnerability from csaf_redhat
Published
2021-10-19 12:09
Modified
2024-11-24 20:23
Summary
Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update
Notes
Topic
An update is now available for Red Hat Quay 3.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Quay 3.6.0 release
Security Fix(es):
* nodejs-url-parse: incorrect hostname in url parsing (CVE-2018-3774)
* python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c (CVE-2021-25289)
* nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27516)
* nodejs-debug: Regular expression Denial of Service (CVE-2017-16137)
* nodejs-mime: Regular expression Denial of Service (CVE-2017-16138)
* nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format (CVE-2018-1107)
* nodejs-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-16492)
* nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure (CVE-2018-21270)
* nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution (CVE-2019-20920)
* nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS (CVE-2019-20922)
* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)
* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
* nodejs-highlight-js: prototype pollution via a crafted HTML code block (CVE-2020-26237)
* urijs: Hostname spoofing via backslashes in URL (CVE-2020-26291)
* python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow (CVE-2020-35654)
* browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) (CVE-2021-23364)
* nodejs-postcss: Regular expression denial of service during source map parsing (CVE-2021-23368)
* nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js (CVE-2021-23382)
* python-pillow: negative-offset memcpy with an invalid size in TiffDecode.c (CVE-2021-25290)
* python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c (CVE-2021-25291)
* python-pillow: backtracking regex in PDF parser could be used as a DOS attack (CVE-2021-25292)
* python-pillow: out-of-bounds read in SGIRleDecode.c (CVE-2021-25293)
* nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27515)
* python-pillow: reported size of a contained image is not properly checked for a BLP container (CVE-2021-27921)
* python-pillow: reported size of a contained image is not properly checked for an ICNS container (CVE-2021-27922)
* python-pillow: reported size of a contained image is not properly checked for an ICO container (CVE-2021-27923)
* python-pillow: buffer overflow in Convert.c because it allow an attacker to pass controlled parameters directly into a convert function (CVE-2021-34552)
* nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js (CVE-2018-1109)
* lodash: Prototype pollution in utilities function (CVE-2018-3721)
* hoek: Prototype pollution in utilities function (CVE-2018-3728)
* lodash: uncontrolled resource consumption in Data handler causing denial of service (CVE-2019-1010266)
* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
* python-pillow: decoding a crafted PCX file could result in buffer over-read (CVE-2020-35653)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Quay 3.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.6.0 release\n\nSecurity Fix(es):\n\n* nodejs-url-parse: incorrect hostname in url parsing (CVE-2018-3774)\n\n* python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c (CVE-2021-25289)\n\n* nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27516)\n\n* nodejs-debug: Regular expression Denial of Service (CVE-2017-16137)\n\n* nodejs-mime: Regular expression Denial of Service (CVE-2017-16138)\n\n* nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format (CVE-2018-1107)\n\n* nodejs-extend: Prototype pollution can allow attackers to modify object properties (CVE-2018-16492)\n\n* nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure (CVE-2018-21270)\n\n* nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution (CVE-2019-20920)\n\n* nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS (CVE-2019-20922)\n\n* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-highlight-js: prototype pollution via a crafted HTML code block (CVE-2020-26237)\n\n* urijs: Hostname spoofing via backslashes in URL (CVE-2020-26291)\n\n* python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow (CVE-2020-35654)\n\n* browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) (CVE-2021-23364)\n\n* nodejs-postcss: Regular expression denial of service during source map parsing (CVE-2021-23368)\n\n* nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js (CVE-2021-23382)\n\n* python-pillow: negative-offset memcpy with an invalid size in TiffDecode.c (CVE-2021-25290)\n\n* python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c (CVE-2021-25291)\n\n* python-pillow: backtracking regex in PDF parser could be used as a DOS attack (CVE-2021-25292)\n\n* python-pillow: out-of-bounds read in SGIRleDecode.c (CVE-2021-25293)\n\n* nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise (CVE-2021-27515)\n\n* python-pillow: reported size of a contained image is not properly checked for a BLP container (CVE-2021-27921)\n\n* python-pillow: reported size of a contained image is not properly checked for an ICNS container (CVE-2021-27922)\n\n* python-pillow: reported size of a contained image is not properly checked for an ICO container (CVE-2021-27923)\n\n* python-pillow: buffer overflow in Convert.c because it allow an attacker to pass controlled parameters directly into a convert function (CVE-2021-34552)\n\n* nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js (CVE-2018-1109)\n\n* lodash: Prototype pollution in utilities function (CVE-2018-3721)\n\n* hoek: Prototype pollution in utilities function (CVE-2018-3728)\n\n* lodash: uncontrolled resource consumption in Data handler causing denial of service (CVE-2019-1010266)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* python-pillow: decoding a crafted PCX file could result in buffer over-read (CVE-2020-35653)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:3917",
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1500700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500700"
},
{
"category": "external",
"summary": "1500705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500705"
},
{
"category": "external",
"summary": "1545884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545884"
},
{
"category": "external",
"summary": "1545893",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545893"
},
{
"category": "external",
"summary": "1546357",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1546357"
},
{
"category": "external",
"summary": "1547272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547272"
},
{
"category": "external",
"summary": "1608140",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1608140"
},
{
"category": "external",
"summary": "1743096",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743096"
},
{
"category": "external",
"summary": "1840004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004"
},
{
"category": "external",
"summary": "1857412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412"
},
{
"category": "external",
"summary": "1857977",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977"
},
{
"category": "external",
"summary": "1882256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882256"
},
{
"category": "external",
"summary": "1882260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882260"
},
{
"category": "external",
"summary": "1901662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901662"
},
{
"category": "external",
"summary": "1915257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915257"
},
{
"category": "external",
"summary": "1915420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915420"
},
{
"category": "external",
"summary": "1915424",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915424"
},
{
"category": "external",
"summary": "1927293",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927293"
},
{
"category": "external",
"summary": "1934470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934470"
},
{
"category": "external",
"summary": "1934474",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934474"
},
{
"category": "external",
"summary": "1934680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934680"
},
{
"category": "external",
"summary": "1934685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934685"
},
{
"category": "external",
"summary": "1934692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934692"
},
{
"category": "external",
"summary": "1934699",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934699"
},
{
"category": "external",
"summary": "1934705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934705"
},
{
"category": "external",
"summary": "1935384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935384"
},
{
"category": "external",
"summary": "1935396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935396"
},
{
"category": "external",
"summary": "1935401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935401"
},
{
"category": "external",
"summary": "1940759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940759"
},
{
"category": "external",
"summary": "1948763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948763"
},
{
"category": "external",
"summary": "1954150",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954150"
},
{
"category": "external",
"summary": "1955619",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955619"
},
{
"category": "external",
"summary": "1982378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982378"
},
{
"category": "external",
"summary": "PROJQUAY-1417",
"url": "https://issues.redhat.com/browse/PROJQUAY-1417"
},
{
"category": "external",
"summary": "PROJQUAY-1449",
"url": "https://issues.redhat.com/browse/PROJQUAY-1449"
},
{
"category": "external",
"summary": "PROJQUAY-1535",
"url": "https://issues.redhat.com/browse/PROJQUAY-1535"
},
{
"category": "external",
"summary": "PROJQUAY-1583",
"url": "https://issues.redhat.com/browse/PROJQUAY-1583"
},
{
"category": "external",
"summary": "PROJQUAY-1609",
"url": "https://issues.redhat.com/browse/PROJQUAY-1609"
},
{
"category": "external",
"summary": "PROJQUAY-1610",
"url": "https://issues.redhat.com/browse/PROJQUAY-1610"
},
{
"category": "external",
"summary": "PROJQUAY-1791",
"url": "https://issues.redhat.com/browse/PROJQUAY-1791"
},
{
"category": "external",
"summary": "PROJQUAY-1883",
"url": "https://issues.redhat.com/browse/PROJQUAY-1883"
},
{
"category": "external",
"summary": "PROJQUAY-1887",
"url": "https://issues.redhat.com/browse/PROJQUAY-1887"
},
{
"category": "external",
"summary": "PROJQUAY-1926",
"url": "https://issues.redhat.com/browse/PROJQUAY-1926"
},
{
"category": "external",
"summary": "PROJQUAY-1998",
"url": "https://issues.redhat.com/browse/PROJQUAY-1998"
},
{
"category": "external",
"summary": "PROJQUAY-2050",
"url": "https://issues.redhat.com/browse/PROJQUAY-2050"
},
{
"category": "external",
"summary": "PROJQUAY-2100",
"url": "https://issues.redhat.com/browse/PROJQUAY-2100"
},
{
"category": "external",
"summary": "PROJQUAY-2102",
"url": "https://issues.redhat.com/browse/PROJQUAY-2102"
},
{
"category": "external",
"summary": "PROJQUAY-672",
"url": "https://issues.redhat.com/browse/PROJQUAY-672"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3917.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update",
"tracking": {
"current_release_date": "2024-11-24T20:23:31+00:00",
"generator": {
"date": "2024-11-24T20:23:31+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:3917",
"initial_release_date": "2021-10-19T12:09:35+00:00",
"revision_history": [
{
"date": "2021-10-19T12:09:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-10-19T12:09:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-24T20:23:31+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.6.0-35"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.6.0-40"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.6.0-44"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.6.0-45"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"product_id": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.6.0-70"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.6.0-37"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.6.0-44"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"product_id": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.6.0-48"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.6.0-43"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64",
"product_id": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.6.0-62"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-16137",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2017-09-27T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1500705"
}
],
"notes": [
{
"category": "description",
"text": "The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-debug: Regular expression Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of rh-nodejs4-nodejs-debug, rh-nodejs6-nodejs-debug, and rh-nodejs8-nodejs-debug as shipped with Red Hat Software Collections 3. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nRed Hat Virtualization 4.2 EUS includes a vulnerable version of nodejs-debug as a part of the ovirt-engine-api-explorer package. This package is removed in Red Hat Virtualization 4.3.\n\nRed Hat Quay includes the debug library as a dependency of karma-webpack. It is only used at build time, and not runtime so its impact is reduce to low in Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-16137"
},
{
"category": "external",
"summary": "RHBZ#1500705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500705"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-16137",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-16137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137"
}
],
"release_date": "2017-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-debug: Regular expression Denial of Service"
},
{
"cve": "CVE-2017-16138",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2017-09-27T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1500700"
}
],
"notes": [
{
"category": "description",
"text": "The mime module is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-mime: Regular expression Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Virtualization 4.2 EUS contained a vulnerable version of nodejs-mime in the ovirt-engine-dashboard package. This package has been removed in Red Hat Virtualization 4.2.\n\nRed Hat Quay includes mime as a dependency of Karma. It\u0027s only used at build time, not runtime so this vulnerability has a low impact of Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-16138"
},
{
"category": "external",
"summary": "RHBZ#1500700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500700"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-16138",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-16138"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-16138",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16138"
},
{
"category": "external",
"summary": "https://nodesecurity.io/advisories/535",
"url": "https://nodesecurity.io/advisories/535"
}
],
"release_date": "2017-09-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-mime: Regular expression Denial of Service"
},
{
"cve": "CVE-2018-1107",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2018-02-16T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1546357"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat Quay the is-my-json-valid library is included as a build time dependency of protractor. It\u0027s only used at build time, not at runtime reducing the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-1107"
},
{
"category": "external",
"summary": "RHBZ#1546357",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1546357"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-1107",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1107"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1107",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1107"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/npm:is-my-json-valid:20180214",
"url": "https://snyk.io/vuln/npm:is-my-json-valid:20180214"
}
],
"release_date": "2018-02-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format"
},
{
"cve": "CVE-2018-1109",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2018-02-19T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1547272"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in nodejs-braces. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks. The highest threat from this vulnerability is system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Quay includes braces as a dependency of webpack. Braces is only used at build time, not at runtime, reducing the impact of this vulnerability to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-1109"
},
{
"category": "external",
"summary": "RHBZ#1547272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547272"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-1109",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1109"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1109",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1109"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/npm:braces:20180219",
"url": "https://snyk.io/vuln/npm:braces:20180219"
}
],
"release_date": "2018-02-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js"
},
{
"cve": "CVE-2018-3721",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-02-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1545884"
}
],
"notes": [
{
"category": "description",
"text": "lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: Prototype pollution in utilities function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat CloudForms version 4.7 does not ship component lodash, so isn\u0027t affected by this flaw.\n\nRed Hat Virtualization 4.2 EUS includes a vulnerable version of lodash as part of the ovirt-engine-dashboard package. This package has been removed from Red Hat Virtualization 4.3.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-3721"
},
{
"category": "external",
"summary": "RHBZ#1545884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545884"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-3721",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3721"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-3721",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3721"
}
],
"release_date": "2018-02-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "lodash: Prototype pollution in utilities function"
},
{
"cve": "CVE-2018-3728",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-02-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1545893"
}
],
"notes": [
{
"category": "description",
"text": "hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via \u0027merge\u0027 and \u0027applyToDefaults\u0027 functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "hoek: Prototype pollution in utilities function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Quay includes hoek as a dependency of protractor which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-3728"
},
{
"category": "external",
"summary": "RHBZ#1545893",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1545893"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-3728",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-3728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3728"
}
],
"release_date": "2018-02-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "hoek: Prototype pollution in utilities function"
},
{
"cve": "CVE-2018-3774",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-08-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1940759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-url-parse. The wrong hostname can be returned, due to incorrect parsing, which can lead to a variety of vulnerabilities. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-url-parse: incorrect hostname in url parsing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-3774"
},
{
"category": "external",
"summary": "RHBZ#1940759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-3774",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3774"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-3774",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3774"
}
],
"release_date": "2018-07-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs-url-parse: incorrect hostname in url parsing"
},
{
"cve": "CVE-2018-16492",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-07-25T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1608140"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in module extend \u003c2.0.2, ~\u003c3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-extend: Prototype pollution can allow attackers to modify object properties",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Quay includes \u0027extend\u0027 as a build time dependency. It\u0027s not used at runtime reducing the impact of this vulnerability to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-16492"
},
{
"category": "external",
"summary": "RHBZ#1608140",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1608140"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-16492",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16492"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/npm:extend:20180424",
"url": "https://snyk.io/vuln/npm:extend:20180424"
}
],
"release_date": "2018-04-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-extend: Prototype pollution can allow attackers to modify object properties"
},
{
"cve": "CVE-2018-21270",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-12-04T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1927293"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-stringstream. Node.js stringstream module is vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Quay include stringstream as a dependency of Karma. Karma is only used at build time, and not at runtime reducing the impact of this vulnerability to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-21270"
},
{
"category": "external",
"summary": "RHBZ#1927293",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927293"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-21270",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-21270"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-21270",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-21270"
}
],
"release_date": "2020-05-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure"
},
{
"cve": "CVE-2019-20920",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2020-09-18T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1882260"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to arbitrary code execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript into the system. This issue is used to run arbitrary code in a server processing Handlebars templates or on a victim\u0027s browser (effectively serving as Cross-Site Scripting). The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Quay includes Handlebars.js as a development dependency. It does not use Handlebars.js at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat Virtualization includes Handlebars.js in two components. In ovirt-engine-ui-extentions, the version used is newer and is not affected by this flaw. In ovirt-web-ui, Handlebars.js is included as a development dependency and is not used at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat OpenShift Container Platform (OCP) 4 delivers the kibana package, which includes Handlebars.js. From OCP 4.6, the kibana package is no longer shipped and will not be fixed. The openshift4/ose-logging-kibana6 container includes Handlebars.js directly as container first code. The vulnerable version of Handlebars.js is also included in openshift4/ose-grafana, but as the Grafana instance is in read-only mode, the configuration/dashboards cannot be modified.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20920"
},
{
"category": "external",
"summary": "RHBZ#1882260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882260"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20920",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20920"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920"
},
{
"category": "external",
"summary": "https://www.npmjs.com/advisories/1316",
"url": "https://www.npmjs.com/advisories/1316"
},
{
"category": "external",
"summary": "https://www.npmjs.com/advisories/1324",
"url": "https://www.npmjs.com/advisories/1324"
}
],
"release_date": "2019-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution"
},
{
"cve": "CVE-2019-20922",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-09-18T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1882256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to a denial of service. The package\u0027s parser may be forced into an endless loop while processing specially-crafted templates. This flaw allows attackers to exhaust system resources, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Quay includes Handlebars.js as a development dependency. It does not use Handlebars.js at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat Virtualization includes Handlebars.js in two components. In ovirt-engine-ui-extentions, the version used is newer and not affected by this flaw. In the ovirt-web-ui,Handlebars.js is included as a development dependency and is not used at runtime to process templates, so it has been given a low impact rating.\n\nRed Hat OpenShift Container Platform (OCP) 4 delivers the kibana package, which includes Handlebars.js. From OCP 4.6, the kibana package is no longer shipped and will not be fixed. The openshift4/ose-logging-kibana6 container includes Handlebars.js directly as container first code. The vulnerable version of Handlebars.js is also included in openshift4/ose-grafana, but as the Grafana instance is in read-only mode, the configuration/dashboards cannot be modified.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20922"
},
{
"category": "external",
"summary": "RHBZ#1882256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20922",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20922"
},
{
"category": "external",
"summary": "https://www.npmjs.com/advisories/1300",
"url": "https://www.npmjs.com/advisories/1300"
}
],
"release_date": "2019-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS"
},
{
"cve": "CVE-2019-1010266",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-07-17T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1743096"
}
],
"notes": [
{
"category": "description",
"text": "lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: uncontrolled resource consumption in Data handler causing denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-1010266"
},
{
"category": "external",
"summary": "RHBZ#1743096",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743096"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-1010266",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1010266"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010266",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010266"
}
],
"release_date": "2019-04-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "lodash: uncontrolled resource consumption in Data handler causing denial of service"
},
{
"cve": "CVE-2020-7608",
"cwe": {
"id": "CWE-267",
"name": "Privilege Defined With Unsafe Actions"
},
"discovery_date": "2020-05-11T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1840004"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in nodesjs-yargs-parser, where it can be tricked into adding or modifying properties of the Object.prototype using a \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-yargs-parser: prototype pollution vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-7608"
},
{
"category": "external",
"summary": "RHBZ#1840004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840004"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-7608",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7608"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7608"
}
],
"release_date": "2020-03-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-yargs-parser: prototype pollution vulnerability"
},
{
"cve": "CVE-2020-8203",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2020-07-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1857412"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-lodash: prototype pollution in zipObjectDeep function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In OpenShift ServiceMesh (OSSM), Red Hat OpenShift Jaeger (RHOSJ) and Red Hat OpenShift Container Platform (RHOCP), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-lodash library to authenticated users only, therefore the impact is low.\n\nRed Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-lodash library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.\n\nRed Hat Virtualization uses vulnerable version of nodejs-lodash, however zipObjectDeep is not used, therefore the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8203"
},
{
"category": "external",
"summary": "RHBZ#1857412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8203",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8203"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/712065",
"url": "https://hackerone.com/reports/712065"
},
{
"category": "external",
"summary": "https://www.npmjs.com/advisories/1523",
"url": "https://www.npmjs.com/advisories/1523"
}
],
"release_date": "2020-04-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-lodash: prototype pollution in zipObjectDeep function"
},
{
"cve": "CVE-2020-15366",
"cwe": {
"id": "CWE-471",
"name": "Modification of Assumed-Immutable Data (MAID)"
},
"discovery_date": "2020-07-15T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1857977"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-ajv library to authenticated users only, therefore the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-15366"
},
{
"category": "external",
"summary": "RHBZ#1857977",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857977"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15366"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/SNYK-JS-AJV-584908",
"url": "https://snyk.io/vuln/SNYK-JS-AJV-584908"
}
],
"release_date": "2020-07-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function"
},
{
"cve": "CVE-2020-26237",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2020-11-24T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1901662"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-highlight-js. Highlight.js is vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object\u0027s prototype during highlighting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-highlight-js: prototype pollution via a crafted HTML code block",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat Virtualization, ovirt-engine-api-explorer uses a vulnerable version of highlight.js, however since release 4.4.3 ovirt-engine-api-explorer is obsoleted and no longer used.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-26237"
},
{
"category": "external",
"summary": "RHBZ#1901662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901662"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-26237",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26237"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26237",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26237"
},
{
"category": "external",
"summary": "https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx",
"url": "https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx"
}
],
"release_date": "2020-11-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-highlight-js: prototype pollution via a crafted HTML code block"
},
{
"cve": "CVE-2020-26291",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-01-12T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1915257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urijs. The hostname can be spoofed by using a backslash (`\\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urijs: Hostname spoofing via backslashes in URL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-26291"
},
{
"category": "external",
"summary": "RHBZ#1915257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-26291",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26291"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-26291",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26291"
},
{
"category": "external",
"summary": "https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155",
"url": "https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155"
},
{
"category": "external",
"summary": "https://github.com/medialize/URI.js/releases/tag/v1.19.4",
"url": "https://github.com/medialize/URI.js/releases/tag/v1.19.4"
},
{
"category": "external",
"summary": "https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg",
"url": "https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/urijs",
"url": "https://www.npmjs.com/package/urijs"
}
],
"release_date": "2020-12-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urijs: Hostname spoofing via backslashes in URL"
},
{
"cve": "CVE-2020-35653",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-01-12T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1915420"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. The PcxDecode in Pillow has a buffer over-read when decoding a crafted PCX file due to the user-supplied stride value trusted for buffer calculations. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Buffer over-read in PCX image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-35653"
},
{
"category": "external",
"summary": "RHBZ#1915420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915420"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-35653",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35653"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35653",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35653"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security"
}
],
"release_date": "2021-01-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "python-pillow: Buffer over-read in PCX image reader"
},
{
"cve": "CVE-2020-35654",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2021-01-12T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1915424"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "python-pillow as shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw as the flaw was introduced in a newer version than shipped.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-35654"
},
{
"category": "external",
"summary": "RHBZ#1915424",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915424"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-35654",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35654"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35654",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35654"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security"
}
],
"release_date": "2021-01-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow"
},
{
"cve": "CVE-2021-23364",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-04-30T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1955619"
}
],
"notes": [
{
"category": "description",
"text": "Regular Expression Denial of Service (ReDoS) vulnerability was found in browserslist library. An attacker can use this vulnerability to parse a query which potentially can lead to service degradation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "While some components do package a vulnerable version of nodejs browserslist library, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. \nThis applies to the following products:\n - OpenShift Container Platform (OCP)\n - OpenShift ServiceMesh (OSSM)\n - Red Hat Advanced Cluster Management for Kubernetes (RHACM)\n\nIn Red Had Quay , whilst a vulnerable version of `browserslist` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-23364"
},
{
"category": "external",
"summary": "RHBZ#1955619",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955619"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-23364",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23364"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23364",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23364"
}
],
"release_date": "2021-04-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS)"
},
{
"cve": "CVE-2021-23368",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-04-12T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1948763"
}
],
"notes": [
{
"category": "description",
"text": "A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss`. When parsing a supplied CSS string, if it contains an unexpected value then as the supplied CSS grows in length it will take an ever increasing amount of time to process. An attacker can use this vulnerability to potentially craft a malicious a long CSS value to process resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-postcss: Regular expression denial of service during source map parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-postcss library to authenticated users only, therefore the impact is low.\n\nRed Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-postcss library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.\n\nIn Red Had Quay , whilst a vulnerable version of `postcss` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.\n\nIn Red Hat Virtualization a vulnerable version of postcss is used in cockpit-ovirt, ovirt-web-ui and ovirt-engine-ui-extensions. However, it is only used during development and is used to process known CSS content. This flaw has been marked as \"wontfix\" and it may be addressed in future updates.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-23368"
},
{
"category": "external",
"summary": "RHBZ#1948763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-23368",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23368"
}
],
"release_date": "2021-04-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-postcss: Regular expression denial of service during source map parsing"
},
{
"cve": "CVE-2021-23382",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-04-26T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1954150"
}
],
"notes": [
{
"category": "description",
"text": "A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss` when using getAnnotationURL() or loadAnnotation() options in lib/previous-map.js. An attacker can use this vulnerability to potentially craft a malicious CSS to process resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-postcss library to authenticated users only, therefore the impact is low.\n\nRed Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-postcss library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.\n\nIn Red Had Quay , whilst a vulnerable version of `postcss` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-23382"
},
{
"category": "external",
"summary": "RHBZ#1954150",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954150"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-23382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23382"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23382",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23382"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640",
"url": "https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640"
}
],
"release_date": "2021-04-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js"
},
{
"cve": "CVE-2021-25289",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. The previous fix for CVE-2020-35654 was insufficient due to incorrect error checking in TiffDecode.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "python-pillow as shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw as the flaw was introduced in a newer version than shipped.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25289"
},
{
"category": "external",
"summary": "RHBZ#1934680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25289",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25289"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25289",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25289"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c"
},
{
"cve": "CVE-2021-25290",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. In TiffDecode.c, there is a negative-offset memcpy with an invalid size which could lead to a system crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Negative-offset memcpy in TIFF image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25290"
},
{
"category": "external",
"summary": "RHBZ#1934685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25290",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25290"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25290",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25290"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Negative-offset memcpy in TIFF image reader"
},
{
"cve": "CVE-2021-25291",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934692"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. Invalid tile boundaries could lead to an OOB Read in TiffReadRGBATile in TiffDecode.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue does not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 8 as it does not include the vulnerable code, which was introduced in a newer upstream version than what what shipped.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25291"
},
{
"category": "external",
"summary": "RHBZ#1934692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25291",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25291"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25291",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25291"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c"
},
{
"cve": "CVE-2021-25292",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934699"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Regular expression DoS in PDF format parser",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25292"
},
{
"category": "external",
"summary": "RHBZ#1934699",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934699"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25292",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25292"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Regular expression DoS in PDF format parser"
},
{
"cve": "CVE-2021-25293",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2021-03-01T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934705"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. There is an Out of Bounds Read in SGIRleDecode.c.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Out-of-bounds read in SGI RLE image reader",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-25293"
},
{
"category": "external",
"summary": "RHBZ#1934705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934705"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-25293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25293"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-25293",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25293"
}
],
"release_date": "2021-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Out-of-bounds read in SGI RLE image reader"
},
{
"cve": "CVE-2021-27515",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934474"
}
],
"notes": [
{
"category": "description",
"text": "An input validation flaw exists in the node.js-url-parse, which results in the URL being incorrectly set to the document location protocol instead of the URL being passed as an argument. This flaw allows an attacker to bypass security checks on URLs. The highest threat from this vulnerability is to integrity. This is an incomplete fix for CVE-2020-8124.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27515"
},
{
"category": "external",
"summary": "RHBZ#1934474",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934474"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27515",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27515"
}
],
"release_date": "2021-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise"
},
{
"cve": "CVE-2021-27516",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1934470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nodejs-urijs where URI.js (urijs) mishandles certain uses of the backslash such as http:\\/ and interprets the URI as a relative path. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Quay includes the urijs dependency in it\u0027s package.lock file but it\u0027s not used anywhere in the code.\n\nRed Hat Advanced Cluster Management for Kubernetes uses Quay as a service, but not code from Quay that exists in RHACM.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27516"
},
{
"category": "external",
"summary": "RHBZ#1934470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1934470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27516",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27516"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27516",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27516"
}
],
"release_date": "2021-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise"
},
{
"cve": "CVE-2021-27921",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1935384"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive memory allocation in BLP image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27921"
},
{
"category": "external",
"summary": "RHBZ#1935384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935384"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27921",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27921"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27921",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27921"
}
],
"release_date": "2021-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive memory allocation in BLP image reader"
},
{
"cve": "CVE-2021-27922",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1935396"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive memory allocation in ICNS image reader",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27922"
},
{
"category": "external",
"summary": "RHBZ#1935396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935396"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27922",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27922"
}
],
"release_date": "2021-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive memory allocation in ICNS image reader"
},
{
"cve": "CVE-2021-27923",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2021-03-03T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1935401"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Excessive memory allocation in ICO image reader",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-27923"
},
{
"category": "external",
"summary": "RHBZ#1935401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935401"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-27923",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27923"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27923",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27923"
}
],
"release_date": "2021-03-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "workaround",
"details": "Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Excessive memory allocation in ICO image reader"
},
{
"cve": "CVE-2021-34552",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2021-07-13T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1982378"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-pillow. This flaw allows an attacker to pass controlled parameters directly into a convert function, triggering a buffer overflow in the \"convert()\" or \"ImagingConvertTransparent()\" functions in Convert.c. The highest threat to this vulnerability is to system availability.\r\n\r\nIn Red Hat Quay, a vulnerable version of python-pillow is shipped with quay-registry-container, however the invoice generation feature which uses python-pillow is disabled by default. Therefore impact has been rated Moderate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Buffer overflow in image convert function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Due to the compiler options used, the buffer overflow is detected and the impact is lowered to a crash only. Additionally, the \"mode\" parameter has to be attacker controlled, which is considered a rare case.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"known_not_affected": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-34552"
},
{
"category": "external",
"summary": "RHBZ#1982378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982378"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-34552",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34552"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-34552",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34552"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow"
}
],
"release_date": "2021-07-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-10-19T12:09:35+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:3917"
},
{
"category": "workaround",
"details": "To mitigate this flaw on Red Hat Quay, keep the invoice generation feature disabled, as it is by default.\n\nRed Hat Satellite 6.9 customers can apply following hotfix to eliminate the vulnerability warnings.\n* Download python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm from https://bugzilla.redhat.com/attachment.cgi?id=1819471\n* Stop services:\n# satellite-maintain service stop\n* Upgrade python2-daemon and remove affected package\n# rpm -Uvh python2-daemon-2.1.2-7.1.HFRHBZ1998199.el7sat.noarch.rpm\n# yum remove python-pillow\n* Restart services:\n# satellite-maintain service start\n\nSatellite 6.10 future release is also fixing this.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:2cb015d00c209fa894958afccbb5ab03c0cc08d74789412343d40564c790b96d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:89ff146ee1ca5fd079bfc1d1dc2f84d3215edbeb7b540f7dde390d1508133229_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8ed9531542037756f556ab478b54b216e4ae631d72477dba6784eb75657d3646_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:03862af902623b5c0f8ab0ce4bac896624fb0325ff5089e6cc0426f125891e6e_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:0125935ef8a605c55c0a68233177f7ee84b9a0bc3331f496945d72c87aa84cb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:bbb7a3a4cfd9c98df1037c58d3e68e1cd8e554c0af336b08a04a914285c68edb_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:860794203beca60e5961b0e69aae97c7e6d6f7e3867b476d1cc458523ec0804b_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:7eeea8b3c3f9ddade8e989a5227fe2e01b7dff0546350017117a10155f16fbe1_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:0b9639c1895923a625980cd57316065b0e192e5ae6a6a7ca5e7d31289d42f7a0_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/quay-rhel8@sha256:d8dd1cd5ccc8231a1228371935700f61f71ffcb9bc3134fe7f37c822a8ec41d3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-pillow: Buffer overflow in image convert function"
}
]
}
ghsa-f5g8-5qq7-938w
Vulnerability from github
Published
2021-03-18 19:55
Modified
2024-10-08 13:05
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
8.3 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
8.3 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
Pillow Out-of-bounds Read
Details
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-35653"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-12T23:15:44Z",
"nvd_published_at": "2021-01-12T09:15:00Z",
"severity": "HIGH"
},
"details": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
"id": "GHSA-f5g8-5qq7-938w",
"modified": "2024-10-08T13:05:45Z",
"published": "2021-03-18T19:55:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35653"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/commit/2f409261eb1228e166868f8f0b5da5cda52e55bf"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f5g8-5qq7-938w"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-69.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-pillow/Pillow"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Pillow Out-of-bounds Read"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.