{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Developer Hub 1.3.0 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Developer Hub (RHDH) is Red Hat\u0027s enterprise-grade, self-managed,\ncustomizable developer portal based on Backstage.io.  RHDH is supported on\nOpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features\nof RHDH include a single pane of glass, a centralized software catalog,\nself-service via golden path templates, and Tech Docs. RHDH is extensible by\nplugins.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2024:7523",
        "url": "https://access.redhat.com/errata/RHBA-2024:7523"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.3",
        "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.3"
      },
      {
        "category": "external",
        "summary": "RHIDP-3725",
        "url": "https://issues.redhat.com/browse/RHIDP-3725"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_7523.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.3.0 release",
    "tracking": {
      "current_release_date": "2026-06-04T00:09:53+00:00",
      "generator": {
        "date": "2026-06-04T00:09:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHBA-2024:7523",
      "initial_release_date": "2024-10-02T15:29:03+00:00",
      "revision_history": [
        {
          "date": "2024-10-02T15:29:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-10-02T15:29:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-04T00:09:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Developer Hub 1.3 for RHEL 9",
                "product": {
                  "name": "Red Hat Developer Hub 1.3 for RHEL 9",
                  "product_id": "9Base-RHDH-1.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhdh:1.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Developer Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
                "product": {
                  "name": "rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
                  "product_id": "rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9\u0026tag=1.3-100"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
                "product": {
                  "name": "rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
                  "product_id": "rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-operator-bundle\u0026tag=1.3-95"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64",
                "product": {
                  "name": "rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64",
                  "product_id": "rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/rhdh-rhel9-operator\u0026tag=1.3-96"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64 as a component of Red Hat Developer Hub 1.3 for RHEL 9",
          "product_id": "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        },
        "product_reference": "rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
        "relates_to_product_reference": "9Base-RHDH-1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64 as a component of Red Hat Developer Hub 1.3 for RHEL 9",
          "product_id": "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64"
        },
        "product_reference": "rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
        "relates_to_product_reference": "9Base-RHDH-1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64 as a component of Red Hat Developer Hub 1.3 for RHEL 9",
          "product_id": "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        },
        "product_reference": "rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64",
        "relates_to_product_reference": "9Base-RHDH-1.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-4067",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2024-05-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2280601"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the NPM package `micromatch` where it is vulnerable to a regular expression denial of service (ReDoS). The issue occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will readily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn\u0027t find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won\u0027t start backtracking the regular expression due to greedy matching.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "micromatch: vulnerable to Regular Expression Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-4067"
        },
        {
          "category": "external",
          "summary": "RHBZ#2280601",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280601"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-4067",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-4067"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-4067",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4067"
        },
        {
          "category": "external",
          "summary": "https://devhub.checkmarx.com/cve-details/CVE-2024-4067/",
          "url": "https://devhub.checkmarx.com/cve-details/CVE-2024-4067/"
        },
        {
          "category": "external",
          "summary": "https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448",
          "url": "https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448"
        },
        {
          "category": "external",
          "summary": "https://github.com/micromatch/micromatch/issues/243",
          "url": "https://github.com/micromatch/micromatch/issues/243"
        },
        {
          "category": "external",
          "summary": "https://github.com/micromatch/micromatch/pull/247",
          "url": "https://github.com/micromatch/micromatch/pull/247"
        }
      ],
      "release_date": "2023-12-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "micromatch: vulnerable to Regular Expression Denial of Service"
    },
    {
      "cve": "CVE-2024-4068",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2024-05-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2280600"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the NPM package `braces.` It fails to limit the number of characters it can handle, which could lead to memory exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, causing the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "braces: fails to limit the number of characters it can handle",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-4068"
        },
        {
          "category": "external",
          "summary": "RHBZ#2280600",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280600"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-4068",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-4068"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-4068",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4068"
        },
        {
          "category": "external",
          "summary": "https://devhub.checkmarx.com/cve-details/CVE-2024-4068/",
          "url": "https://devhub.checkmarx.com/cve-details/CVE-2024-4068/"
        },
        {
          "category": "external",
          "summary": "https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308",
          "url": "https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308"
        },
        {
          "category": "external",
          "summary": "https://github.com/micromatch/braces/issues/35",
          "url": "https://github.com/micromatch/braces/issues/35"
        }
      ],
      "release_date": "2024-03-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "braces: fails to limit the number of characters it can handle"
    },
    {
      "cve": "CVE-2024-21529",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "discovery_date": "2024-09-11T05:20:09.464815+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2311418"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the dset package. Affected versions of this package are vulnerable to Prototype Pollution via the dset function due to improper user input sanitization. This vulnerability allows the attacker to inject a malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dset: Prototype Pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Prototype Pollution is rated with as Important severity issue because it exploits the fundamental inheritance mechanism of JavaScript objects, allowing an attacker to maliciously alter the global Object.prototype. This can lead to widespread and unpredictable behavior across the entire application, as all objects inherit from this polluted prototype. The consequences can range from denial of service (DoS), where important functions like toString() are rendered unusable, to remote code execution (RCE), where injected properties are executed in privileged contexts.\n\n\nrhdh-hub-container 1.2 include the patch for this vulnerability starting at 1.2.5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-21529"
        },
        {
          "category": "external",
          "summary": "RHBZ#2311418",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311418"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-21529",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-21529"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-21529",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21529"
        },
        {
          "category": "external",
          "summary": "https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa",
          "url": "https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa"
        },
        {
          "category": "external",
          "summary": "https://security.snyk.io/vuln/SNYK-JS-DSET-7116691",
          "url": "https://security.snyk.io/vuln/SNYK-JS-DSET-7116691"
        }
      ],
      "release_date": "2024-09-11T05:15:02.547000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dset: Prototype Pollution"
    },
    {
      "cve": "CVE-2024-24790",
      "cwe": {
        "id": "CWE-115",
        "name": "Misinterpretation of Input"
      },
      "discovery_date": "2024-06-17T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2292787"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go language standard library net/netip. The method Is*() (IsPrivate(), IsPublic(), etc) doesn\u0027t behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to control access to resources or data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE has been marked as moderate as for our products a network-based attack vector is simply impossible when it comes to golang code,apart from that as per CVE flaw analysis reported by golang, this only affects integrity and confidentiality and has no effect on availability, hence CVSS has been marked as such.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24790"
        },
        {
          "category": "external",
          "summary": "RHBZ#2292787",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292787"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24790",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24790"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24790",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24790"
        }
      ],
      "release_date": "2024-06-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses"
    },
    {
      "cve": "CVE-2024-24791",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-07-02T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Denial of service due to improper 100-continue handling in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker\u0027s control. This reduces the severity score of this flaw to Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24791"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/591255",
          "url": "https://go.dev/cl/591255"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/67555",
          "url": "https://go.dev/issue/67555"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
          "url": "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ"
        }
      ],
      "release_date": "2024-07-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Denial of service due to improper 100-continue handling in net/http"
    },
    {
      "cve": "CVE-2024-35255",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2024-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Microsoft\u0027s Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition\u2014a scenario where the timing of events leads to unexpected behavior\u2014during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat build of Apache Camel for Spring boot is not affected as 4.4.1 was released containing a fixed version of the Azure Identity Library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-35255",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499",
          "url": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"
        },
        {
          "category": "external",
          "summary": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340",
          "url": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9",
          "url": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"
        },
        {
          "category": "external",
          "summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
        }
      ],
      "release_date": "2024-07-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity"
    },
    {
      "cve": "CVE-2024-37891",
      "cwe": {
        "id": "CWE-669",
        "name": "Incorrect Resource Transfer Between Spheres"
      },
      "discovery_date": "2024-06-17T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2292788"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the `Proxy-Authorization` HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: proxy-authorization request header is not stripped during cross-origin redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": ".egg-info packages, like urllib3-1.24.2-py3.6.egg-info, store only metadata such as package version and dependencies and do not contain any affected codebase.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-37891"
        },
        {
          "category": "external",
          "summary": "RHBZ#2292788",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292788"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-37891",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-37891"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-37891",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37891"
        }
      ],
      "release_date": "2024-06-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: proxy-authorization request header is not stripped during cross-origin redirects"
    },
    {
      "cve": "CVE-2024-39008",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "discovery_date": "2024-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295029"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the fast-loops Node.js package. This flaw allows an attacker to alter the behavior of all objects inheriting from the affected prototype by passing arguments to the objectMergeDeep function crafted with the built-in property: __proto__. This issue can potentially lead to a denial of service, remote code execution, or Cross-site scripting.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-loops: prototype pollution via objectMergeDeep",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-39008"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295029",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295029"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-39008",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-39008"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-39008",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39008"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/mestrtee/f09a507c8d59fbbb7fd40880cd9b87ed",
          "url": "https://gist.github.com/mestrtee/f09a507c8d59fbbb7fd40880cd9b87ed"
        }
      ],
      "release_date": "2024-07-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "fast-loops: prototype pollution via objectMergeDeep"
    },
    {
      "cve": "CVE-2024-39249",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2024-07-01T20:20:32+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295035"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the async Node.js package. A Regular expression Denial of Service (ReDoS) attack can potentially be triggered via the autoinject function while parsing specially crafted input.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-async: Regular expression denial of service while parsing function in autoinject",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-39249"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295035",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295035"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-39249",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-39249"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-39249",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39249"
        },
        {
          "category": "external",
          "summary": "https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L41",
          "url": "https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L41"
        },
        {
          "category": "external",
          "summary": "https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L6",
          "url": "https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L6"
        },
        {
          "category": "external",
          "summary": "https://github.com/zunak/CVE-2024-39249",
          "url": "https://github.com/zunak/CVE-2024-39249"
        }
      ],
      "release_date": "2024-07-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs-async: Regular expression denial of service while parsing function in autoinject"
    },
    {
      "cve": "CVE-2024-43796",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-09-10T15:30:28.106254+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2311152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Express. This vulnerability allows untrusted code execution via passing untrusted user input to response.redirect(), even if the input is sanitized.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "express: Improper Input Handling in Express Redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-43796"
        },
        {
          "category": "external",
          "summary": "RHBZ#2311152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-43796",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-43796"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553",
          "url": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx",
          "url": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"
        }
      ],
      "release_date": "2024-09-10T15:15:17.510000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "express: Improper Input Handling in Express Redirects"
    },
    {
      "cve": "CVE-2024-43800",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2024-09-10T15:30:33.631718+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2311154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect().",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "serve-static: Improper Sanitization in serve-static",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "rhdh-hub-container 1.2 and 1.3 have included patches for this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
        ],
        "known_not_affected": [
          "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
          "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-43800"
        },
        {
          "category": "external",
          "summary": "RHBZ#2311154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-43800",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-43800"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b",
          "url": "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa",
          "url": "https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p",
          "url": "https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p"
        }
      ],
      "release_date": "2024-09-10T15:15:17.937000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-02T15:29:03+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:7523"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-RHDH-1.3:rhdh/rhdh-hub-rhel9@sha256:ccc2f05dd6dacbe9b39bbe5b4774ef9d61b872fa7c26e47c0c63d260920ad436_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-operator-bundle@sha256:717ddb1edb2f3ba94fa68d5310dfe2c0b4aa0a3a75747011b1cd4d6956d982e3_amd64",
            "9Base-RHDH-1.3:rhdh/rhdh-rhel9-operator@sha256:4984c6cc3d35be00fa8758b2ddbb2712ad0085b557ff1bac9cc885a47bc20bf4_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "serve-static: Improper Sanitization in serve-static"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.r5: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.r4: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: XXE vulnerability in XSLT transforms in \n* CVE-2024-8391 io.vertx/vertx-grpc-server: Vertx gRPC server does not limit the maximum message size\n* CVE-2024-8391 io.vertx/vertx-grpc-client: Vertx gRPC server does not limit the maximum message size\n* CVE-2024-32007 org.apache.cxf/cxf-rt-rs-security-jose: apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE\n* CVE-2024-41172 org.apache.cxf/cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients\n* CVE-2024-35255 com.azure/azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7052",
        "url": "https://access.redhat.com/errata/RHSA-2024:7052"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-45294",
        "url": "https://access.redhat.com/security/cve/CVE-2024-45294"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-8391",
        "url": "https://access.redhat.com/security/cve/CVE-2024-8391"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-32007",
        "url": "https://access.redhat.com/security/cve/CVE-2024-32007"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-41172",
        "url": "https://access.redhat.com/security/cve/CVE-2024-41172"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-35255",
        "url": "https://access.redhat.com/security/cve/CVE-2024-35255"
      },
      {
        "category": "external",
        "summary": "2295081",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295081"
      },
      {
        "category": "external",
        "summary": "2298828",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298828"
      },
      {
        "category": "external",
        "summary": "2298829",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298829"
      },
      {
        "category": "external",
        "summary": "2309758",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309758"
      },
      {
        "category": "external",
        "summary": "2310447",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310447"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7052.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA)",
    "tracking": {
      "current_release_date": "2026-06-02T15:17:04+00:00",
      "generator": {
        "date": "2026-06-02T15:17:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2024:7052",
      "initial_release_date": "2024-09-24T12:51:36+00:00",
      "revision_history": [
        {
          "date": "2024-09-24T12:51:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-24T12:51:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-02T15:17:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Apache Camel 4 for Quarkus 3",
                "product": {
                  "name": "Red Hat build of Apache Camel 4 for Quarkus 3",
                  "product_id": "Red Hat build of Apache Camel 4 for Quarkus 3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:3.8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Build of Apache Camel"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-8391",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-04T16:20:44.762419+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309758"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the gRPC server in Eclipse Vert.x, which does not limit the maximum length of the message payload. This may lead to excessive memory consumption in a server or a client, causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.vertx:vertx-grpc-client: io.vertx:vertx-grpc-server: Vertx gRPC server does not limit the maximum message size",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4 for Quarkus 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8391"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309758",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309758"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8391",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8391"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8391",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8391"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse-vertx/vertx-grpc/issues/113",
          "url": "https://github.com/eclipse-vertx/vertx-grpc/issues/113"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/31",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/31"
        }
      ],
      "release_date": "2024-09-04T16:15:09.253000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.vertx:vertx-grpc-client: io.vertx:vertx-grpc-server: Vertx gRPC server does not limit the maximum message size"
    },
    {
      "cve": "CVE-2024-32007",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-07-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2298828"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An improper input validation vulnerability was found in the p2c parameter in the Apache CXF JOSE. This flaw allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The improper input validation vulnerability in the p2c parameter of Apache CXF JOSE is considered a moderate severity issue rather than a important one due to its limited scope and impact. While the flaw allows an attacker to specify a large value for the p2c parameter, leading to potential denial of service (DoS) attacks by causing excessive computational overhead, it does not compromise data integrity, confidentiality, or authentication mechanisms directly. The attack vector primarily affects system availability and exploiting this vulnerability requires the ability to send crafted tokens.\n\nBase EAP (7.4 and 8) and EAP XP (4 and 5) do not ship this affected CXF jaxrs artifact. cxf-rt-rs-security-jose is part of CXF\u0027s JAX-RS, and EAP uses RESTEasy, hence it\u0027s not-affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4 for Quarkus 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-32007"
        },
        {
          "category": "external",
          "summary": "RHBZ#2298828",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298828"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-32007",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-32007"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-32007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32007"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-6pff-fmh2-4mmf",
          "url": "https://github.com/advisories/GHSA-6pff-fmh2-4mmf"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633",
          "url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"
        }
      ],
      "release_date": "2024-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE"
    },
    {
      "cve": "CVE-2024-35255",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2024-07-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Microsoft\u0027s Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition\u2014a scenario where the timing of events leads to unexpected behavior\u2014during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat build of Apache Camel for Spring boot is not affected as 4.4.1 was released containing a fixed version of the Azure Identity Library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4 for Quarkus 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-35255",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499",
          "url": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"
        },
        {
          "category": "external",
          "summary": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340",
          "url": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9",
          "url": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"
        },
        {
          "category": "external",
          "summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
        }
      ],
      "release_date": "2024-07-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity"
    },
    {
      "cve": "CVE-2024-41172",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2024-07-19T09:20:34+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2298829"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory consumption flaw was found in Apache CXF. This issue may allow a CXF HTTP client conduit to prevent HTTPClient instances from being garbage collected, eventually causing the application to run out of memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache: cxf: org.apache.cxf:cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4 for Quarkus 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-41172"
        },
        {
          "category": "external",
          "summary": "RHBZ#2298829",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298829"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-41172",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-41172"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-41172",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41172"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-4mgg-fqfq-64hg",
          "url": "https://github.com/advisories/GHSA-4mgg-fqfq-64hg"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6",
          "url": "https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6"
        },
        {
          "category": "external",
          "summary": "https://osv.dev/vulnerability/GHSA-4mgg-fqfq-64hg",
          "url": "https://osv.dev/vulnerability/GHSA-4mgg-fqfq-64hg"
        }
      ],
      "release_date": "2024-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache: cxf: org.apache.cxf:cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients"
    },
    {
      "cve": "CVE-2024-45294",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2024-09-06T16:20:11.403869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2310447"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations (XSLT) transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This issue impacts use cases where org.hl7.fhir.core is being used within a host where external clients can submit XML.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is of significant severity because it allows for XML External Entity (XXE) injection, which can lead to unauthorized access and leakage of sensitive data from the host system. In environments where external clients are permitted to submit XML files, an attacker could craft a malicious XML containing a DTD (Document Type Definition) that references external entities. When processed, this could result in the unauthorized disclosure of files, environmental variables, or other confidential data from the server, potentially compromising the integrity and confidentiality of the system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel 4 for Quarkus 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "RHBZ#2310447",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310447"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45294",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45294",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23",
          "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23"
        },
        {
          "category": "external",
          "summary": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf",
          "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf"
        }
      ],
      "release_date": "2024-09-06T16:15:03.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel 4 for Quarkus 3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.r5: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.r4: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.dstu3: XXE vulnerability in XSLT transforms in \n* CVE-2024-45294 ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may: XXE vulnerability in XSLT transforms in \n* CVE-2024-8391 io.vertx/vertx-grpc-server: Vertx gRPC server does not limit the maximum message size\n* CVE-2024-8391 io.vertx/vertx-grpc-client: Vertx gRPC server does not limit the maximum message size\n* CVE-2024-32007 org.apache.cxf/cxf-rt-rs-security-jose: apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE\n* CVE-2024-41172 org.apache.cxf/cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients\n* CVE-2024-35255 com.azure/azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:7052",
        "url": "https://access.redhat.com/errata/RHSA-2024:7052"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-45294",
        "url": "https://access.redhat.com/security/cve/CVE-2024-45294"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-8391",
        "url": "https://access.redhat.com/security/cve/CVE-2024-8391"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-32007",
        "url": "https://access.redhat.com/security/cve/CVE-2024-32007"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-41172",
        "url": "https://access.redhat.com/security/cve/CVE-2024-41172"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-35255",
        "url": "https://access.redhat.com/security/cve/CVE-2024-35255"
      },
      {
        "category": "external",
        "summary": "2295081",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295081"
      },
      {
        "category": "external",
        "summary": "2298828",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298828"
      },
      {
        "category": "external",
        "summary": "2298829",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298829"
      },
      {
        "category": "external",
        "summary": "2309758",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309758"
      },
      {
        "category": "external",
        "summary": "2310447",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310447"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7052.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA)",
    "tracking": {
      "current_release_date": "2024-12-17T14:23:49+00:00",
      "generator": {
        "date": "2024-12-17T14:23:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2024:7052",
      "initial_release_date": "2024-09-24T12:51:36+00:00",
      "revision_history": [
        {
          "date": "2024-09-24T12:51:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-24T12:51:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-17T14:23:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Apache Camel for Quarkus",
                "product": {
                  "name": "Red Hat build of Apache Camel for Quarkus",
                  "product_id": "Red Hat build of Apache Camel for Quarkus",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:3.8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Build of Apache Camel"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-8391",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-09-04T16:20:44.762419+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2309758"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the gRPC server in Eclipse Vert.x, which does not limit the maximum length of the message payload. This may lead to excessive memory consumption in a server or a client, causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.vertx:vertx-grpc-client: io.vertx:vertx-grpc-server: Vertx gRPC server does not limit the maximum message size",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel for Quarkus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-8391"
        },
        {
          "category": "external",
          "summary": "RHBZ#2309758",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309758"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-8391",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-8391"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8391",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8391"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse-vertx/vertx-grpc/issues/113",
          "url": "https://github.com/eclipse-vertx/vertx-grpc/issues/113"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/31",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/31"
        }
      ],
      "release_date": "2024-09-04T16:15:09.253000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.vertx:vertx-grpc-client: io.vertx:vertx-grpc-server: Vertx gRPC server does not limit the maximum message size"
    },
    {
      "cve": "CVE-2024-32007",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-07-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2298828"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An improper input validation vulnerability was found in the p2c parameter in the Apache CXF JOSE. This flaw allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The improper input validation vulnerability in the p2c parameter of Apache CXF JOSE is considered a moderate severity issue rather than a important one due to its limited scope and impact. While the flaw allows an attacker to specify a large value for the p2c parameter, leading to potential denial of service (DoS) attacks by causing excessive computational overhead, it does not compromise data integrity, confidentiality, or authentication mechanisms directly. The attack vector primarily affects system availability and exploiting this vulnerability requires the ability to send crafted tokens.\n\nBase EAP (7.4 and 8) and EAP XP (4 and 5) do not ship this affected CXF jaxrs artifact. cxf-rt-rs-security-jose is part of CXF\u0027s JAX-RS, and EAP uses RESTEasy, hence it\u0027s not-affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel for Quarkus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-32007"
        },
        {
          "category": "external",
          "summary": "RHBZ#2298828",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298828"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-32007",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-32007"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-32007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32007"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-6pff-fmh2-4mmf",
          "url": "https://github.com/advisories/GHSA-6pff-fmh2-4mmf"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633",
          "url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"
        }
      ],
      "release_date": "2024-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE"
    },
    {
      "cve": "CVE-2024-35255",
      "discovery_date": "2024-07-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Microsoft\u0027s Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition\u2014a scenario where the timing of events leads to unexpected behavior\u2014during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel for Quarkus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-35255",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499",
          "url": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"
        },
        {
          "category": "external",
          "summary": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340",
          "url": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9",
          "url": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"
        },
        {
          "category": "external",
          "summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
        }
      ],
      "release_date": "2024-07-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity"
    },
    {
      "cve": "CVE-2024-41172",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2024-07-19T09:20:34+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2298829"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory consumption flaw was found in Apache CXF. This issue may allow a CXF HTTP client conduit to prevent HTTPClient instances from being garbage collected, eventually causing the application to run out of memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache: cxf: org.apache.cxf:cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel for Quarkus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-41172"
        },
        {
          "category": "external",
          "summary": "RHBZ#2298829",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298829"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-41172",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-41172"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-41172",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41172"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-4mgg-fqfq-64hg",
          "url": "https://github.com/advisories/GHSA-4mgg-fqfq-64hg"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6",
          "url": "https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6"
        },
        {
          "category": "external",
          "summary": "https://osv.dev/vulnerability/GHSA-4mgg-fqfq-64hg",
          "url": "https://osv.dev/vulnerability/GHSA-4mgg-fqfq-64hg"
        }
      ],
      "release_date": "2024-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "apache: cxf: org.apache.cxf:cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients"
    },
    {
      "cve": "CVE-2024-45294",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2024-09-06T16:20:11.403869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2310447"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations (XSLT) transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This issue impacts use cases where org.hl7.fhir.core is being used within a host where external clients can submit XML.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is of significant severity because it allows for XML External Entity (XXE) injection, which can lead to unauthorized access and leakage of sensitive data from the host system. In environments where external clients are permitted to submit XML files, an attacker could craft a malicious XML containing a DTD (Document Type Definition) that references external entities. When processed, this could result in the unauthorized disclosure of files, environmental variables, or other confidential data from the server, potentially compromising the integrity and confidentiality of the system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Apache Camel for Quarkus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "RHBZ#2310447",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310447"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45294",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45294",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45294"
        },
        {
          "category": "external",
          "summary": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23",
          "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23"
        },
        {
          "category": "external",
          "summary": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf",
          "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf"
        }
      ],
      "release_date": "2024-09-06T16:15:03.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-24T12:51:36+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:7052"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Apache Camel for Quarkus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.hl7.fhir.core: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r4b: org.hl7.fhir.r5: org.hl7.fhir.utilities: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cert-manager Operator for Red Hat OpenShift 1.15.0",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to developers working within your Kubernetes cluster.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:0536",
        "url": "https://access.redhat.com/errata/RHSA-2025:0536"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html",
        "url": "https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-35255",
        "url": "https://access.redhat.com/security/cve/CVE-2024-35255"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-45288",
        "url": "https://access.redhat.com/security/cve/CVE-2023-45288"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-24783",
        "url": "https://access.redhat.com/security/cve/CVE-2024-24783"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-28180",
        "url": "https://access.redhat.com/security/cve/CVE-2024-28180"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-6104",
        "url": "https://access.redhat.com/security/cve/CVE-2024-6104"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-45337",
        "url": "https://access.redhat.com/security/cve/CVE-2024-45337"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-45338",
        "url": "https://access.redhat.com/security/cve/CVE-2024-45338"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0536.json"
      }
    ],
    "title": "Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0",
    "tracking": {
      "current_release_date": "2026-06-08T09:27:14+00:00",
      "generator": {
        "date": "2026-06-08T09:27:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.2"
        }
      },
      "id": "RHSA-2025:0536",
      "initial_release_date": "2025-01-21T16:57:37+00:00",
      "revision_history": [
        {
          "date": "2025-01-21T16:57:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-04-01T21:11:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-08T09:27:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "cert-manager operator for Red Hat OpenShift 1.15",
                "product": {
                  "name": "cert-manager operator for Red Hat OpenShift 1.15",
                  "product_id": "cert-manager operator for Red Hat OpenShift 1.15",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cert_manager:1.15::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "cert-manager operator for Red Hat OpenShift"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3Aa1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0?arch=amd64\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3A49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25?arch=amd64\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3A30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e?arch=s390x\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3A2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173?arch=s390x\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3Adf96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8?arch=ppc64le\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3A4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531?arch=ppc64le\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3A68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6?arch=arm64\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Ac1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1?arch=arm64\u0026repository_url=registry.redhat.io/cert-manager"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Bartek Nowotarski"
          ],
          "organization": "nowotarski.info"
        }
      ],
      "cve": "CVE-2023-45288",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-03-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268273"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is not a suitable mitigation for all use cases. Once an attack has ended, the system should return to normal operations on its own.\n\nThis vulnerability only impacts servers which have HTTP/2 enabled. It stems from an imperfect definition of the protocol. As the Go programming language is widely utilized across nearly every major Red Hat offering, a full listing of impacted packages will not be provided. Therefore, the \u201cAffected Packages and Issued Red Hat Security Errata\u201d section contains a simplified list of what offerings need to remediate this vulnerability. Every impacted offering has at least one representative component listed, but potentially not all of them. Rest assured that Red Hat is committed to remediating this vulnerability across our entire portfolio.\n\nMany components are rated as Low impact due to configurations which reduce the attack surface or  significantly increase the difficulty of exploitation. A summary of these scenarios are:\n* The container includes a package that provides a vulnerable webserver, but it is not used or running during operation\n* HTTP/2 is disabled by default and is not supported\n* Only a client implementation is provided, which is not vulnerable\n* A vulnerable module (either golang.org/net/http or golang.org/x/net/http2) is included, but disabled\n* Access to a vulnerable server is restricted within the container (loopback only connections)\n* Golang is available in the container but is not used\n\n\nWithin the Red Hat OpenShift Container Platform, the majority of vulnerable components are not externally accessible. This means an attacker must already have access to a container within your environment to exploit this vulnerability. However, the ose-hyperkube (openshift-enterprise-hyperkube) container is externally accessible, so there are less barriers to exploitation. Fixes for this specific container are already available.\n\nWithin Red Hat Ansible Automation Platform, the impacted component is Receptor. The impact has been reduced to Low as the vulnerable code is present, but not utilized. There are three potential exposures within this component:\n* Receptor utilizes QUIC a UDP based protocol which does not run over HTTP/2\n* Receptor utilizes the x/net/ipv4 and ipv6 packages, both of which are not affected",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268273",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45288",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "https://nowotarski.info/http2-continuation-flood/",
          "url": "https://nowotarski.info/http2-continuation-flood/"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2687",
          "url": "https://pkg.go.dev/vuln/GO-2024-2687"
        },
        {
          "category": "external",
          "summary": "https://www.kb.cert.org/vuls/id/421644",
          "url": "https://www.kb.cert.org/vuls/id/421644"
        }
      ],
      "release_date": "2024-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-21T16:57:37+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\nSee \u0027https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html\u0027 for additional information.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0536"
        },
        {
          "category": "workaround",
          "details": "In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS"
    },
    {
      "cve": "CVE-2024-6104",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "discovery_date": "2024-06-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2294000"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "go-retryablehttp: url might write sensitive information to log file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-6104"
        },
        {
          "category": "external",
          "summary": "RHBZ#2294000",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294000"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-6104",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-6104"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-6104",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6104"
        }
      ],
      "release_date": "2024-06-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-21T16:57:37+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\nSee \u0027https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html\u0027 for additional information.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0536"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "go-retryablehttp: url might write sensitive information to log file"
    },
    {
      "cve": "CVE-2024-24783",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2024-03-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268019"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24783"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268019",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268019"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp",
          "url": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/569339",
          "url": "https://go.dev/cl/569339"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/65390",
          "url": "https://go.dev/issue/65390"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2598",
          "url": "https://pkg.go.dev/vuln/GO-2024-2598"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20240329-0005",
          "url": "https://security.netapp.com/advisory/ntap-20240329-0005"
        }
      ],
      "release_date": "2024-03-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-21T16:57:37+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\nSee \u0027https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html\u0027 for additional information.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0536"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm"
    },
    {
      "cve": "CVE-2024-28180",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2024-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268854"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jose-go: improper handling of highly compressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-28180"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268854",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268854"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-28180",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-28180"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-28180",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28180"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g",
          "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g"
        }
      ],
      "release_date": "2024-03-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-21T16:57:37+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\nSee \u0027https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html\u0027 for additional information.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0536"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jose-go: improper handling of highly compressed data"
    },
    {
      "cve": "CVE-2024-35255",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2024-07-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2295081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Microsoft\u0027s Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition\u2014a scenario where the timing of events leads to unexpected behavior\u2014during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat build of Apache Camel for Spring boot is not affected as 4.4.1 was released containing a fixed version of the Azure Identity Library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "RHBZ#2295081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-35255",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
        },
        {
          "category": "external",
          "summary": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499",
          "url": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"
        },
        {
          "category": "external",
          "summary": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340",
          "url": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9",
          "url": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"
        },
        {
          "category": "external",
          "summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
        }
      ],
      "release_date": "2024-07-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-21T16:57:37+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\nSee \u0027https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html\u0027 for additional information.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0536"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity"
    },
    {
      "cve": "CVE-2024-45337",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2024-12-11T19:00:54.247490+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331720"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is classified as important rather than critical because it does not directly enable unauthorized access but rather introduces a risk of authorization bypass if the application or library misuses the PublicKeyCallback API. The vulnerability relies on incorrect assumptions made by the application when handling the sequence or state of keys provided during SSH authentication. Properly implemented systems that use the Permissions field or avoid relying on external state remain unaffected. Additionally, the vulnerability does not allow direct exploitation to gain control over a system without the presence of insecure logic in the application\u0027s handling of authentication attempts.\n\n\nRed Hat Enterprise Linux(RHEL) 8 \u0026 9 and Red Hat Openshift marked as not affected as it was determined that the problem function `ServerConfig.PublicKeyCallback`, as noted in the CVE-2024-45337 issue, is not called by Podman, Buildah, containers-common, or the gvisor-tap-vsock projects.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331720",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331720"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45337",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909",
          "url": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/635315",
          "url": "https://go.dev/cl/635315"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/70779",
          "url": "https://go.dev/issue/70779"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ",
          "url": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3321",
          "url": "https://pkg.go.dev/vuln/GO-2024-3321"
        }
      ],
      "release_date": "2024-12-11T18:55:58.506000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-21T16:57:37+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\nSee \u0027https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html\u0027 for additional information.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0536"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto"
    },
    {
      "cve": "CVE-2024-45338",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-12-18T21:00:59.938173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2333122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. This flaw allows an attacker to craft input to the parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This issue can cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an attacker can craft malicious input that causes the parsing functions to process data non-linearly, resulting in significant delays which leads to a denial of service by exhausting system resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
          "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "RHBZ#2333122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45338",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45338",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/637536",
          "url": "https://go.dev/cl/637536"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/70906",
          "url": "https://go.dev/issue/70906"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ",
          "url": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3333",
          "url": "https://pkg.go.dev/vuln/GO-2024-3333"
        }
      ],
      "release_date": "2024-12-18T20:38:22.660000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-21T16:57:37+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\nSee \u0027https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html\u0027 for additional information.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0536"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64",
            "cert-manager operator for Red Hat OpenShift 1.15:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html"
    }
  ]
}