Action not permitted
Modal body text goes here.
cve-2021-44531
Vulnerability from cvelistv5
Published
2022-02-24 18:27
Modified
2024-08-04 04:25
Severity ?
EPSS score ?
Summary
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
References
▼ | URL | Tags | |
---|---|---|---|
support@hackerone.com | https://hackerone.com/reports/1429694 | Issue Tracking, Mitigation, Patch, Third Party Advisory | |
support@hackerone.com | https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ | Release Notes, Vendor Advisory | |
support@hackerone.com | https://security.netapp.com/advisory/ntap-20220325-0007/ | Third Party Advisory | |
support@hackerone.com | https://www.debian.org/security/2022/dsa-5170 | Third Party Advisory | |
support@hackerone.com | https://www.oracle.com/security-alerts/cpuapr2022.html | Patch, Third Party Advisory | |
support@hackerone.com | https://www.oracle.com/security-alerts/cpujul2022.html | Third Party Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
n/a | https://github.com/nodejs/node |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T04:25:16.807Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://hackerone.com/reports/1429694" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20220325-0007/" }, { "name": "DSA-5170", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2022/dsa-5170" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "https://github.com/nodejs/node", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Fixed in 12.22.9, 14.18.3, 16.13.2, 17.3.1" } ] } ], "descriptions": [ { "lang": "en", "value": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-295", "description": "Improper Certificate Validation (CWE-295)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-07-25T16:40:56", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://hackerone.com/reports/1429694" }, { "tags": [ "x_refsource_MISC" ], "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20220325-0007/" }, { "name": "DSA-5170", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2022/dsa-5170" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2021-44531", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "https://github.com/nodejs/node", "version": { "version_data": [ { "version_value": "Fixed in 12.22.9, 14.18.3, 16.13.2, 17.3.1" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Improper Certificate Validation (CWE-295)" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/1429694", "refsource": "MISC", "url": "https://hackerone.com/reports/1429694" }, { "name": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "refsource": "MISC", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "name": "https://security.netapp.com/advisory/ntap-20220325-0007/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20220325-0007/" }, { "name": "DSA-5170", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2022/dsa-5170" }, { "name": "https://www.oracle.com/security-alerts/cpujul2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2021-44531", "datePublished": "2022-02-24T18:27:00", "dateReserved": "2021-12-02T00:00:00", "dateUpdated": "2024-08-04T04:25:16.807Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-44531\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2022-02-24T19:15:09.313\",\"lastModified\":\"2022-10-05T13:56:24.620\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.\"},{\"lang\":\"es\",\"value\":\"Aceptar tipos de nombres alternativos de sujeto (SAN) arbitrarios, a menos que una PKI est\u00e9 definida espec\u00edficamente para usar un tipo de SAN concreto, puede resultar en una omisi\u00f3n de los intermediarios con restricci\u00f3n de nombre. Node.js versiones anteriores a 12.22.9, versiones anteriores a 14.18.3, versiones anteriores a 16.13.2 y versiones anteriores a 17.3.1, aceptaba tipos de URI SAN, que las PKI no suelen estar definidas para usar. Adem\u00e1s, cuando un protocolo permite URI SANs, Node.js no hac\u00eda coincidir el URI correctamente. Las versiones de Node.js con la correcci\u00f3n para esto deshabilitan el tipo URI SAN cuando comprueban un certificado contra un nombre de host. Este comportamiento puede revertirse mediante la opci\u00f3n de l\u00ednea de comandos --security-revert\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.8},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]},{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"12.22.9\",\"matchCriteriaId\":\"DAE16BC9-7B14-48DA-ADEB-D1898E0B9885\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndExcluding\":\"14.18.3\",\"matchCriteriaId\":\"8499B085-A803-4958-BB99-8E7FABB177BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"16.0.0\",\"versionEndExcluding\":\"16.13.2\",\"matchCriteriaId\":\"113157AB-0571-4244-A857-ADE4F4EA1F11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"17.0.0\",\"versionEndExcluding\":\"17.3.1\",\"matchCriteriaId\":\"9DF5B801-BC99-4F91-B350-C14A5998532C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"079F2588-2746-408B-9BB0-9A569289985B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"51600424-E294-41E0-9C8B-12D0C3456027\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"C3D12B98-032F-49A6-B237-E0CAD32D9A25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.28\",\"matchCriteriaId\":\"727AE4B8-ECED-4942-B378-AC869D39D8D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.29\",\"matchCriteriaId\":\"B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.7.37\",\"matchCriteriaId\":\"361CAD5F-8866-44CC-A47E-C0E98A9FAABA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndIncluding\":\"8.0.28\",\"matchCriteriaId\":\"3D713546-8144-491B-B3D9-FBE437E4A442\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.28\",\"matchCriteriaId\":\"7BDC629D-CC4C-4903-8A06-BF5823457996\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8AF00C6-B97F-414D-A8DF-057E6BFD8597\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.29\",\"matchCriteriaId\":\"CDB1E9C2-30CD-4DD2-BB9F-AF59B8DA9B9E\"}]}]}],\"references\":[{\"url\":\"https://hackerone.com/reports/1429694\",\"source\":\"support@hackerone.com\",\"tags\":[\"Issue Tracking\",\"Mitigation\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20220325-0007/\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2022/dsa-5170\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"support@hackerone.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"support@hackerone.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
gsd-2021-44531
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2021-44531", "description": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.", "id": "GSD-2021-44531", "references": [ "https://www.suse.com/security/cve/CVE-2021-44531.html", "https://advisories.mageia.org/CVE-2021-44531.html", "https://access.redhat.com/errata/RHSA-2022:4914", "https://www.debian.org/security/2022/dsa-5170", "https://access.redhat.com/errata/RHEA-2022:4925", "https://access.redhat.com/errata/RHEA-2022:5139", "https://access.redhat.com/errata/RHEA-2022:5221", "https://access.redhat.com/errata/RHEA-2022:5615", "https://access.redhat.com/errata/RHSA-2022:7044", "https://access.redhat.com/errata/RHSA-2022:7830", "https://access.redhat.com/errata/RHSA-2022:9073" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2021-44531" ], "details": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.", "id": "GSD-2021-44531", "modified": "2023-12-13T01:23:20.272217Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2021-44531", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "https://github.com/nodejs/node", "version": { "version_data": [ { "version_value": "Fixed in 12.22.9, 14.18.3, 16.13.2, 17.3.1" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Improper Certificate Validation (CWE-295)" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/1429694", "refsource": "MISC", "url": "https://hackerone.com/reports/1429694" }, { "name": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "refsource": "MISC", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "name": "https://security.netapp.com/advisory/ntap-20220325-0007/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20220325-0007/" }, { "name": "DSA-5170", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2022/dsa-5170" }, { "name": "https://www.oracle.com/security-alerts/cpujul2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003c=8.0.28", "affected_versions": "All versions up to 8.0.28", "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cwe_ids": [ "CWE-1035", "CWE-295", "CWE-937" ], "date": "2022-10-05", "description": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js does not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.", "fixed_versions": [ "8.0.29" ], "identifier": "CVE-2021-44531", "identifiers": [ "CVE-2021-44531" ], "not_impacted": "All versions after 8.0.28", "package_slug": "pypi/mysql-connector-python", "pubdate": "2022-02-24", "solution": "Upgrade to version 8.0.29 or above.", "title": "Improper Certificate Validation", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "https://hackerone.com/reports/1429694", "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "https://security.netapp.com/advisory/ntap-20220325-0007/", "https://www.oracle.com/security-alerts/cpuapr2022.html", "https://www.debian.org/security/2022/dsa-5170", "https://www.oracle.com/security-alerts/cpujul2022.html" ], "uuid": "f8028f90-13ef-489e-95dc-0f87175ead24" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndExcluding": "17.3.1", "versionStartIncluding": "17.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndExcluding": "16.13.2", "versionStartIncluding": "16.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndExcluding": "14.18.3", "versionStartIncluding": "14.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe_name": [], "versionEndExcluding": "12.22.9", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "8.0.29", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "8.0.28", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "8.0.28", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "8.0.28", "versionStartIncluding": "8.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "5.7.37", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "8.0.29", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve-assignments@hackerone.com", "ID": "CVE-2021-44531" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-295" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/1429694", "refsource": "MISC", "tags": [ "Issue Tracking", "Mitigation", "Patch", "Third Party Advisory" ], "url": "https://hackerone.com/reports/1429694" }, { "name": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "refsource": "MISC", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" }, { "name": "https://security.netapp.com/advisory/ntap-20220325-0007/", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://security.netapp.com/advisory/ntap-20220325-0007/" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "name": "DSA-5170", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2022/dsa-5170" }, { "name": "N/A", "refsource": "N/A", "tags": [ "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 5.2 } }, "lastModifiedDate": "2022-10-05T13:56Z", "publishedDate": "2022-02-24T19:15Z" } } }
rhsa-2022_7044
Vulnerability from csaf_redhat
Published
2022-10-19 10:12
Modified
2024-11-06 01:48
Summary
Red Hat Security Advisory: rh-nodejs14-nodejs security update
Notes
Topic
An update for rh-nodejs14-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs14-nodejs is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:7044", "url": "https://access.redhat.com/errata/RHSA-2022:7044" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7044.json" } ], "title": "Red Hat Security Advisory: rh-nodejs14-nodejs security update", "tracking": { "current_release_date": "2024-11-06T01:48:06+00:00", "generator": { "date": "2024-11-06T01:48:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:7044", "initial_release_date": "2022-10-19T10:12:45+00:00", "revision_history": [ { "date": "2022-10-19T10:12:45+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-10-19T10:12:45+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:48:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for RHEL(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "product": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "product_id": "rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.20.1-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "product_id": "rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.20.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "product_id": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.20.1-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "product_id": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.20.1.2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.20.1-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "product": { "name": "rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "product_id": "rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-docs@14.20.1-2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "product_id": "rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.20.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "product_id": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.20.1-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "product_id": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.20.1.2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.20.1-2.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.20.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.20.1-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "product": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "product_id": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.17-14.20.1.2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.20.1-2.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-10-19T10:12:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-10-19T10:12:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-10-19T10:12:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-10-19T10:12:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-10-19T10:12:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-10-19T10:12:45+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7044" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.20.1-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.20.1-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.17-14.20.1.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" } ] }
rhsa-2022_4914
Vulnerability from csaf_redhat
Published
2022-06-06 09:29
Modified
2024-11-06 01:00
Summary
Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update
Notes
Topic
An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.22.12). This is the last planned rebase before the collection reaches End of Life.
Security Fix(es):
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.22.12). This is the last planned rebase before the collection reaches End of Life.\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:4914", "url": "https://access.redhat.com/errata/RHSA-2022:4914" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4914.json" } ], "title": "Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-06T01:00:44+00:00", "generator": { "date": "2024-11-06T01:00:44+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:4914", "initial_release_date": "2022-06-06T09:29:16+00:00", "revision_history": [ { "date": "2022-06-06T09:29:16+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-06T09:29:16+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:00:44+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for RHEL(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.22.12-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "product": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "product_id": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.16-12.22.12.2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.22.12-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "product": { "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "product_id": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-docs@12.22.12-2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.22.12-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "product": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "product_id": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.16-12.22.12.2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.22.12-2.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.22.12-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "product": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "product_id": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.16-12.22.12.2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.22.12-2.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhsa-2022_9073
Vulnerability from csaf_redhat
Published
2022-12-15 16:20
Modified
2024-11-06 02:09
Summary
Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).
Security Fix(es):
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [rhel-8] (BZ#2151625)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [rhel-8] (BZ#2151625)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:9073", "url": "https://access.redhat.com/errata/RHSA-2022:9073" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142806", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142806" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_9073.json" } ], "title": "Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-06T02:09:52+00:00", "generator": { "date": "2024-11-06T02:09:52+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:9073", "initial_release_date": "2022-12-15T16:20:58+00:00", "revision_history": [ { "date": "2022-12-15T16:20:58+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-12-15T16:20:58+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T02:09:52+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:16:8070020221207164159:bd1311ed", "product": { "name": "nodejs:16:8070020221207164159:bd1311ed", "product_id": "nodejs:16:8070020221207164159:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@16:8070020221207164159:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "product": { "name": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "product_id": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B17412%2Bbb0e4a6b?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "product": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-2.module%2Bel8.7.0%2B17412%2Bbb0e4a6b?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.18.1-3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "product": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "product_id": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.19.2-1.16.18.1.3.module%2Bel8.7.0%2B17465%2B1a1abd74?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, "product_reference": "nodejs:16:8070020221207164159:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch" }, "product_reference": "nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64 as a component of nodejs:16:8070020221207164159:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" }, "product_reference": "npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-12-15T16:20:58+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:9073" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:16:8070020221207164159:bd1311ed:npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" } ] }
rhsa-2023_1742
Vulnerability from csaf_redhat
Published
2023-04-12 15:04
Modified
2024-11-06 02:44
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.21.3).
Security Fix(es):
* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1742", "url": "https://access.redhat.com/errata/RHSA-2023:1742" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "2142822", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142822" }, { "category": "external", "summary": "2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "2175827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175827" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-06T02:44:39+00:00", "generator": { "date": "2024-11-06T02:44:39+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:1742", "initial_release_date": "2023-04-12T15:04:47+00:00", "revision_history": [ { "date": "2023-04-12T15:04:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-04-12T15:04:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T02:44:39+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8060020230306170237:ad008a3a", "product": { "name": "nodejs:14:8060020230306170237:ad008a3a", "product_id": "nodejs:14:8060020230306170237:ad008a3a", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8060020230306170237:ad008a3a" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product": { "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product_id": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.20-3.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.21.3-1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product_id": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.18-1.14.21.3.1.module%2Bel8.6.0%2B18532%2Bcbe6f646?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, "product_reference": "nodejs:14:8060020230306170237:ad008a3a", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch" }, "product_reference": "nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src" }, "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64 as a component of nodejs:14:8060020230306170237:ad008a3a as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" }, "product_reference": "npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-0235", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2022-01-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2044591" } ], "notes": [ { "category": "description", "text": "A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as \"Authorization,\" \"WWW-Authenticate,\" and \"Cookie\" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized actor.", "title": "Vulnerability description" }, { "category": "summary", "text": "node-fetch: exposure of sensitive information to an unauthorized actor", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is out of support scope for dotnet-5.0. For more information about Dotnet product support scope, please see https://access.redhat.com/support/policy/updates/net-core", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-0235" }, { "category": "external", "summary": "RHBZ#2044591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044591" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0235", "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0235" }, { "category": "external", "summary": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/", "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/" } ], "release_date": "2022-01-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "node-fetch: exposure of sensitive information to an unauthorized actor" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-4904", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2023-02-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2168631" } ], "notes": [ { "category": "description", "text": "A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "c-ares: buffer overflow in config_sortlist() due to missing string length check", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a disruption of the availability of an application, yet doesn\u2019t compromise data integrity or confidentiality. The opportunity for disruption is further limited due to the requirement that an application allows an attacker to be able to input both untrusted and unvalidated data. Exploiting this flaw requires an application to use the library in such a way that would allow untrusted and unvalidated input to be passed directly to ares_set_sortlist by an attacker. In the event that this is able to occur, the impact to RHEL is limited to a crash of the application due to the protections offered by default in RHEL systems such as Stack Smashing Protection (SSP).", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4904" }, { "category": "external", "summary": "RHBZ#2168631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168631" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4904", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4904" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904" }, { "category": "external", "summary": "https://github.com/c-ares/c-ares/issues/496", "url": "https://github.com/c-ares/c-ares/issues/496" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "c-ares: buffer overflow in config_sortlist() due to missing string length check" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "cve": "CVE-2022-24999", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150323" } ], "notes": [ { "category": "description", "text": "A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "express: \"qs\" prototype poisoning causes the hang of the node process", "title": "Vulnerability summary" }, { "category": "other", "text": "- The qs and express Package is not used by the OpenShift Container Platform console directly and is only a third-party package dependency. Hence, it is marked as wontfix. \nAs a result, any services that depend on Openshift for their use of qs and express are marked won\u0027t fix. \n- In OpenShift Service Mesh, \u0027qs\u0027 is hoisted from storybook and node-sass, both are dev dependencies, and the vulnerability is not exposed to end users. Hence marked as wontfix.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24999" }, { "category": "external", "summary": "RHBZ#2150323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999" }, { "category": "external", "summary": "https://github.com/expressjs/express/releases/tag/4.17.3", "url": "https://github.com/expressjs/express/releases/tag/4.17.3" }, { "category": "external", "summary": "https://github.com/ljharb/qs/pull/428", "url": "https://github.com/ljharb/qs/pull/428" }, { "category": "external", "summary": "https://github.com/n8tz/CVE-2022-24999", "url": "https://github.com/n8tz/CVE-2022-24999" } ], "release_date": "2022-11-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "express: \"qs\" prototype poisoning causes the hang of the node process" }, { "cve": "CVE-2022-25881", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2023-01-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2165824" } ], "notes": [ { "category": "description", "text": "A flaw was found in http-cache-semantics. When the server reads the cache policy from the request using this library, a Regular Expression Denial of Service occurs, caused by malicious request header values sent to the server.", "title": "Vulnerability description" }, { "category": "summary", "text": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25881" }, { "category": "external", "summary": "RHBZ#2165824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165824" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881" } ], "release_date": "2023-01-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" }, { "cve": "CVE-2022-38900", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-02-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170644" } ], "notes": [ { "category": "description", "text": "A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "decode-uri-component: improper input validation resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "For OpenShift Container Platform (OCP), Advanced Clusters Management for Kubernetes (ACM) and Advanced Cluster Security (ACS), the NPM decode-uri-component package is only present in source repositories as a development dependency, it is not used in production. Therefore this vulnerability is rated Low for OCP and ACS.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the decode-uri-component package. \nThe vulnerable code is not used, hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38900" }, { "category": "external", "summary": "RHBZ#2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900" }, { "category": "external", "summary": "https://github.com/SamVerschueren/decode-uri-component/issues/5", "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq" } ], "release_date": "2022-11-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "decode-uri-component: improper input validation resulting in DoS" }, { "cve": "CVE-2022-43548", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "discovery_date": "2022-11-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140911" } ], "notes": [ { "category": "description", "text": "A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: DNS rebinding in inspect via invalid octal IP address", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43548" }, { "category": "external", "summary": "RHBZ#2140911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43548", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43548" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548", "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548" } ], "release_date": "2022-11-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: DNS rebinding in inspect via invalid octal IP address" }, { "cve": "CVE-2023-23918", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2171935" } ], "notes": [ { "category": "description", "text": "A privilege escalation vulnerability exists in Node.js \u003c19.6.1, \u003c18.14.1, \u003c16.19.1 and \u003c14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: Permissions policies can be bypassed via process.mainModule", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23918" }, { "category": "external", "summary": "RHBZ#2171935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2171935" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23918", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Node.js: Permissions policies can be bypassed via process.mainModule" }, { "cve": "CVE-2023-23920", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "discovery_date": "2023-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2172217" } ], "notes": [ { "category": "description", "text": "An untrusted search path vulnerability exists in Node.js. \u003c19.6.1, \u003c18.14.1, \u003c16.19.1, and \u003c14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-23920" }, { "category": "external", "summary": "RHBZ#2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-23920", "url": "https://www.cve.org/CVERecord?id=CVE-2023-23920" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920" } ], "release_date": "2023-02-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-04-12T15:04:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debuginfo-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-debugsource-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-devel-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-docs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-full-i18n-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.x86_64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-nodemon-0:2.0.20-3.module+el8.6.0+18532+cbe6f646.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.aarch64", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.ppc64le", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.s390x", "AppStream-8.6.0.Z.EUS:nodejs:14:8060020230306170237:ad008a3a:npm-1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Node.js: insecure loading of ICU data through ICU_DATA environment variable" } ] }
rhsa-2023_3742
Vulnerability from csaf_redhat
Published
2023-06-21 15:22
Modified
2024-11-06 03:15
Summary
Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
Notes
Topic
Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multicloud data management service with an S3 compatible API.
Security Fix(es):
* goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238)
* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
* vault: Hashicorp Vault AWS IAM Integration Authentication Bypass (CVE-2020-16250)
* vault: GCP Auth Method Allows Authentication Bypass (CVE-2020-16251)
* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
* go-yaml: Denial of Service in go-yaml (CVE-2021-4235)
* vault: incorrect policy enforcement (CVE-2021-43998)
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
* jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass (CVE-2022-23540)
* jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC (CVE-2022-23541)
* golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
* golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
* golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190)
* consul: Consul Template May Expose Vault Secrets When Processing Invalid Input (CVE-2022-38149)
* vault: insufficient certificate revocation list checking (CVE-2022-41316)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
* golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File (CVE-2023-0620)
* hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata (CVE-2023-0665)
* Hashicorp/vault: Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation (CVE-2023-24999)
* hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations (CVE-2023-25000)
* validator: Inefficient Regular Expression Complexity in Validator.js (CVE-2021-3765)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
* golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multicloud data management service with an S3 compatible API.\n\nSecurity Fix(es):\n\n* goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238)\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* vault: Hashicorp Vault AWS IAM Integration Authentication Bypass (CVE-2020-16250)\n\n* vault: GCP Auth Method Allows Authentication Bypass (CVE-2020-16251)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* go-yaml: Denial of Service in go-yaml (CVE-2021-4235)\n\n* vault: incorrect policy enforcement (CVE-2021-43998)\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)\n\n* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass (CVE-2022-23540)\n\n* jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC (CVE-2022-23541)\n\n* golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)\n\n* golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)\n\n* golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190)\n\n* consul: Consul Template May Expose Vault Secrets When Processing Invalid Input (CVE-2022-38149)\n\n* vault: insufficient certificate revocation list checking (CVE-2022-41316)\n\n* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)\n\n* golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)\n\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n\n* vault: Vault\u2019s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File (CVE-2023-0620)\n\n* hashicorp/vault: Vault\u2019s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata (CVE-2023-0665)\n\n* Hashicorp/vault: Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation (CVE-2023-24999)\n\n* hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations (CVE-2023-25000)\n\n* validator: Inefficient Regular Expression Complexity in Validator.js (CVE-2021-3765)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\n* golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:3742", "url": "https://access.redhat.com/errata/RHSA-2023:3742" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index" }, { "category": "external", "summary": "1786696", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1786696" }, { "category": "external", "summary": "1855339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855339" }, { "category": "external", "summary": "1943137", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1943137" }, { "category": "external", "summary": "1944687", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1944687" }, { "category": "external", "summary": "1989088", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1989088" }, { "category": "external", "summary": "2005040", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005040" }, { "category": "external", "summary": "2005830", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2005830" }, { "category": "external", "summary": "2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "2028193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2028193" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2042914", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2042914" }, { "category": "external", "summary": "2052252", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2052252" }, { "category": "external", "summary": "2101497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2101497" }, { "category": "external", "summary": "2101916", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2101916" }, { "category": "external", "summary": "2102304", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2102304" }, { "category": "external", "summary": "2104148", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2104148" }, { "category": "external", "summary": "2107388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107388" }, { "category": "external", "summary": "2113814", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2113814" }, { "category": "external", "summary": "2115020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2115020" }, { "category": "external", "summary": "2115616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2115616" }, { "category": "external", "summary": "2119551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119551" }, { "category": "external", "summary": "2120098", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2120098" }, { "category": "external", "summary": "2120944", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2120944" }, { "category": "external", "summary": "2124668", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124668" }, { "category": "external", "summary": "2124669", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124669" }, { "category": "external", "summary": "2126299", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126299" }, { "category": "external", "summary": "2132867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132867" }, { "category": "external", "summary": "2132868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868" }, { "category": "external", "summary": "2132872", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872" }, { "category": "external", "summary": "2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "2135339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135339" }, { "category": "external", "summary": "2139037", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139037" }, { "category": "external", "summary": "2141095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141095" }, { "category": "external", "summary": "2142651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142651" }, { "category": "external", "summary": "2142894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142894" }, { "category": "external", "summary": "2142941", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142941" }, { "category": "external", "summary": "2143944", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143944" }, { "category": "external", "summary": "2144256", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2144256" }, { "category": "external", "summary": "2151903", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2151903" }, { "category": "external", "summary": "2152143", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2152143" }, { "category": "external", "summary": "2154250", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2154250" }, { "category": "external", "summary": "2155507", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155507" }, { "category": "external", "summary": "2155743", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155743" }, { "category": "external", "summary": "2156067", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156067" }, { "category": "external", "summary": "2156069", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156069" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156519" }, { "category": "external", "summary": "2156727", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156727" }, { "category": "external", "summary": "2156729", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156729" }, { "category": "external", "summary": "2157876", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2157876" }, { "category": "external", "summary": "2158922", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158922" }, { "category": "external", "summary": "2159676", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2159676" }, { "category": "external", "summary": "2161274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274" }, { "category": "external", "summary": "2161879", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161879" }, { "category": "external", "summary": "2161937", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161937" }, { "category": "external", "summary": "2162257", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2162257" }, { "category": "external", "summary": "2164617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2164617" }, { "category": "external", "summary": "2165495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165495" }, { "category": "external", "summary": "2165504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165504" }, { "category": "external", "summary": "2165929", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165929" }, { "category": "external", "summary": "2165938", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165938" }, { "category": "external", "summary": "2165984", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2165984" }, { "category": "external", "summary": "2166222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166222" }, { "category": "external", "summary": "2166234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166234" }, { "category": "external", "summary": "2166869", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166869" }, { "category": "external", "summary": "2167299", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167299" }, { "category": "external", "summary": "2167308", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167308" }, { "category": "external", "summary": "2167337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167337" }, { "category": "external", "summary": "2167340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167340" }, { "category": "external", "summary": "2167946", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167946" }, { "category": "external", "summary": "2168113", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168113" }, { "category": "external", "summary": "2168635", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168635" }, { "category": "external", "summary": "2168840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168840" }, { "category": "external", "summary": "2168849", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168849" }, { "category": "external", "summary": "2169375", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2169375" }, { "category": "external", "summary": "2169378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2169378" }, { "category": "external", "summary": "2169779", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2169779" }, { "category": "external", "summary": "2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "2170673", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170673" }, { "category": "external", "summary": "2172089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172089" }, { "category": "external", "summary": "2172365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172365" }, { "category": "external", "summary": "2172521", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172521" }, { "category": "external", "summary": "2173161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2173161" }, { "category": "external", "summary": "2173528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2173528" }, { "category": "external", "summary": "2173534", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2173534" }, { "category": "external", "summary": "2173926", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2173926" }, { "category": "external", "summary": "2175612", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175612" }, { "category": "external", "summary": "2175685", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175685" }, { "category": "external", "summary": "2175714", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175714" }, { "category": "external", "summary": "2175867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2175867" }, { "category": "external", "summary": "2176080", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176080" }, { "category": "external", "summary": "2176456", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176456" }, { "category": "external", "summary": "2176739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176739" }, { "category": "external", "summary": "2176776", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176776" }, { "category": "external", "summary": "2176798", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176798" }, { "category": "external", "summary": "2176809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2176809" }, { "category": "external", "summary": "2177134", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177134" }, { "category": "external", "summary": "2177221", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177221" }, { "category": "external", "summary": "2177325", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177325" }, { "category": "external", "summary": "2177695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177695" }, { "category": "external", "summary": "2177844", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177844" }, { "category": "external", "summary": "2178033", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178033" }, { "category": "external", "summary": "2178358", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178358" }, { "category": "external", "summary": "2178488", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178488" }, { "category": "external", "summary": "2178492", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178492" }, { "category": "external", "summary": "2178588", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178588" }, { "category": "external", "summary": "2178619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178619" }, { "category": "external", "summary": "2178682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178682" }, { "category": "external", "summary": "2179133", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179133" }, { "category": "external", "summary": "2179337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179337" }, { "category": "external", "summary": "2179403", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179403" }, { "category": "external", "summary": "2179846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179846" }, { "category": "external", "summary": "2179860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179860" }, { "category": "external", "summary": "2179976", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179976" }, { "category": "external", "summary": "2179981", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179981" }, { "category": "external", "summary": "2179997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179997" }, { "category": "external", "summary": "2180211", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180211" }, { "category": "external", "summary": "2180397", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180397" }, { "category": "external", "summary": "2180440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180440" }, { "category": "external", "summary": "2180921", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180921" }, { "category": "external", "summary": "2181112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181112" }, { "category": "external", "summary": "2181133", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181133" }, { "category": "external", "summary": "2181446", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181446" }, { "category": "external", "summary": "2181535", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181535" }, { "category": "external", "summary": "2181551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181551" }, { "category": "external", "summary": "2181832", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181832" }, { "category": "external", "summary": "2181949", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2181949" }, { "category": "external", "summary": "2182041", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182041" }, { "category": "external", "summary": "2182296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182296" }, { "category": "external", "summary": "2182375", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182375" }, { "category": "external", "summary": "2182644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182644" }, { "category": "external", "summary": "2182664", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182664" }, { "category": "external", "summary": "2182703", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182703" }, { "category": "external", "summary": "2182972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182972" }, { "category": "external", "summary": "2182981", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182981" }, { "category": "external", "summary": "2183155", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2183155" }, { "category": "external", "summary": "2183196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2183196" }, { "category": "external", "summary": "2183266", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2183266" }, { "category": "external", "summary": "2183457", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2183457" }, { "category": "external", "summary": "2183478", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2183478" }, { "category": "external", "summary": "2183520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2183520" }, { "category": "external", "summary": "2184068", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184068" }, { "category": "external", "summary": "2184605", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184605" }, { "category": "external", "summary": "2184663", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184663" }, { "category": "external", "summary": "2184769", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184769" }, { "category": "external", "summary": "2184773", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184773" }, { "category": "external", "summary": "2184892", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184892" }, { "category": "external", "summary": "2184984", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184984" }, { "category": "external", "summary": "2185164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185164" }, { "category": "external", "summary": "2185188", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185188" }, { "category": "external", "summary": "2185757", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185757" }, { "category": "external", "summary": "2185871", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185871" }, { "category": "external", "summary": "2186171", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2186171" }, { "category": "external", "summary": "2186225", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2186225" }, { "category": "external", "summary": "2186475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2186475" }, { "category": "external", "summary": "2186752", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2186752" }, { "category": "external", "summary": "2187251", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2187251" }, { "category": "external", "summary": "2187296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2187296" }, { "category": "external", "summary": "2187736", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2187736" }, { "category": "external", "summary": "2187952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2187952" }, { "category": "external", "summary": "2187969", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2187969" }, { "category": "external", "summary": "2187986", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2187986" }, { "category": "external", "summary": "2188053", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188053" }, { "category": "external", "summary": "2188238", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188238" }, { "category": "external", "summary": "2188303", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188303" }, { "category": "external", "summary": "2188427", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188427" }, { "category": "external", "summary": "2188666", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188666" }, { "category": "external", "summary": "2189483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2189483" }, { "category": "external", "summary": "2189929", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2189929" }, { "category": "external", "summary": "2189982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2189982" }, { "category": "external", "summary": "2189984", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2189984" }, { "category": "external", "summary": "2190129", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2190129" }, { "category": "external", "summary": "2190241", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2190241" }, { "category": "external", "summary": "2192088", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2192088" }, { "category": "external", "summary": "2192670", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2192670" }, { "category": "external", "summary": "2192824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2192824" }, { "category": "external", "summary": "2192875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2192875" }, { "category": "external", "summary": "2193114", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2193114" }, { "category": "external", "summary": "2193220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2193220" }, { "category": "external", "summary": "2196176", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196176" }, { "category": "external", "summary": "2196236", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196236" }, { "category": "external", "summary": "2196298", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2196298" }, { "category": "external", "summary": "2203795", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2203795" }, { "category": "external", "summary": "2208029", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2208029" }, { "category": "external", "summary": "2208079", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2208079" }, { "category": "external", "summary": "2208269", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2208269" }, { "category": "external", "summary": "2208558", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2208558" }, { "category": "external", "summary": "2208962", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2208962" }, { "category": "external", "summary": "2209364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209364" }, { "category": "external", "summary": "2209643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209643" }, { "category": "external", "summary": "2209695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209695" }, { "category": "external", "summary": "2210964", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2210964" }, { "category": "external", "summary": "2211334", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211334" }, { "category": "external", "summary": "2211343", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211343" }, { "category": "external", "summary": "2211704", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211704" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3742.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update", "tracking": { "current_release_date": "2024-11-06T03:15:04+00:00", "generator": { "date": "2024-11-06T03:15:04+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:3742", "initial_release_date": "2023-06-21T15:22:11+00:00", "revision_history": [ { "date": "2023-06-21T15:22:11+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-06-22T19:51:30+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:15:04+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHODF 4.13 for RHEL 9", "product": { "name": "RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_data_foundation:4.13::el9" } } } ], "category": "product_family", "name": "Red Hat OpenShift Data Foundation" }, { "branches": [ { "category": "product_version", "name": "odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "product": { "name": "odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "product_id": "odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "product_identification_helper": { "purl": "pkg:oci/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed?arch=amd64\u0026repository_url=registry.redhat.io/odf4/cephcsi-rhel9\u0026tag=v4.13.0-35" } } }, { "category": "product_version", "name": "odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "product": { "name": "odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "product_id": "odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "product_identification_helper": { "purl": "pkg:oci/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55?arch=amd64\u0026repository_url=registry.redhat.io/odf4/mcg-cli-rhel9\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "product": { "name": "odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "product_id": "odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826?arch=amd64\u0026repository_url=registry.redhat.io/odf4/mcg-core-rhel9\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "product": { "name": "odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "product_id": "odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "product_identification_helper": { "purl": "pkg:oci/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be?arch=amd64\u0026repository_url=registry.redhat.io/odf4/mcg-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "product": { "name": "odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "product_id": "odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "product_identification_helper": { "purl": "pkg:oci/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e?arch=amd64\u0026repository_url=registry.redhat.io/odf4/mcg-rhel9-operator\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "product": { "name": "odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "product_id": "odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de?arch=amd64\u0026repository_url=registry.redhat.io/odf4/ocs-client-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "product": { "name": "odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "product_id": "odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64?arch=amd64\u0026repository_url=registry.redhat.io/odf4/ocs-client-rhel9-operator\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "product": { "name": "odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "product_id": "odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa?arch=amd64\u0026repository_url=registry.redhat.io/odf4/ocs-metrics-exporter-rhel9\u0026tag=v4.13.0-78" } } }, { "category": "product_version", "name": "odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "product": { "name": "odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "product_id": "odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41?arch=amd64\u0026repository_url=registry.redhat.io/odf4/ocs-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "product": { "name": "odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "product_id": "odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "product_identification_helper": { "purl": "pkg:oci/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c?arch=amd64\u0026repository_url=registry.redhat.io/odf4/ocs-rhel9-operator\u0026tag=v4.13.0-67" } } }, { "category": "product_version", "name": "odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "product": { "name": "odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "product_id": "odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-console-rhel9\u0026tag=v4.13.0-85" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "product": { "name": "odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "product_id": "odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "product": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "product_id": "odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "product": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "product_id": "odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "product": { "name": "odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "product_id": "odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-console-rhel9\u0026tag=v4.13.0-81" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "product": { "name": "odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "product_id": "odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "product": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "product_id": "odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "product": { "name": "odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "product_id": "odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-must-gather-rhel9\u0026tag=v4.13.0-35" } } }, { "category": "product_version", "name": "odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "product": { "name": "odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "product_id": "odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "product": { "name": "odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "product_id": "odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "product_identification_helper": { "purl": "pkg:oci/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odf-rhel9-operator\u0026tag=v4.13.0-24" } } }, { "category": "product_version", "name": "odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "product": { "name": "odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "product_id": "odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "product_identification_helper": { "purl": "pkg:oci/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odr-cluster-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "product": { "name": "odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "product_id": "odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "product_identification_helper": { "purl": "pkg:oci/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odr-hub-operator-bundle\u0026tag=v4.13.0-217" } } }, { "category": "product_version", "name": "odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "product": { "name": "odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "product_id": "odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "product_identification_helper": { "purl": "pkg:oci/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615?arch=amd64\u0026repository_url=registry.redhat.io/odf4/odr-rhel9-operator\u0026tag=v4.13.0-33" } } }, { "category": "product_version", "name": "odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "product": { "name": "odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "product_id": "odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "product_identification_helper": { "purl": "pkg:oci/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266?arch=amd64\u0026repository_url=registry.redhat.io/odf4/rook-ceph-rhel9-operator\u0026tag=v4.13.0-70" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "product": { "name": "odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "product_id": "odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "product_identification_helper": { "purl": "pkg:oci/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/cephcsi-rhel9\u0026tag=v4.13.0-35" } } }, { "category": "product_version", "name": "odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "product": { "name": "odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "product_id": "odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/mcg-cli-rhel9\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "product": { "name": "odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "product_id": "odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/mcg-core-rhel9\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "product": { "name": "odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "product_id": "odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "product_identification_helper": { "purl": "pkg:oci/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/mcg-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "product": { "name": "odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "product_id": "odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "product_identification_helper": { "purl": "pkg:oci/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/mcg-rhel9-operator\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "product": { "name": "odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "product_id": "odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/ocs-client-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "product": { "name": "odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "product_id": "odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/ocs-client-rhel9-operator\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "product": { "name": "odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "product_id": "odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/ocs-metrics-exporter-rhel9\u0026tag=v4.13.0-78" } } }, { "category": "product_version", "name": "odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "product": { "name": "odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "product_id": "odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/ocs-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "product": { "name": "odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "product_id": "odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/ocs-rhel9-operator\u0026tag=v4.13.0-67" } } }, { "category": "product_version", "name": "odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "product": { "name": "odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "product_id": "odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-console-rhel9\u0026tag=v4.13.0-85" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "product": { "name": "odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "product_id": "odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "product": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "product_id": "odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "product": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "product_id": "odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "product": { "name": "odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "product_id": "odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-console-rhel9\u0026tag=v4.13.0-81" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "product": { "name": "odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "product_id": "odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "product": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "product_id": "odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "product": { "name": "odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "product_id": "odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-must-gather-rhel9\u0026tag=v4.13.0-35" } } }, { "category": "product_version", "name": "odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "product": { "name": "odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "product_id": "odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "product": { "name": "odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "product_id": "odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odf-rhel9-operator\u0026tag=v4.13.0-24" } } }, { "category": "product_version", "name": "odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "product": { "name": "odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "product_id": "odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odr-cluster-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "product": { "name": "odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "product_id": "odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odr-hub-operator-bundle\u0026tag=v4.13.0-217" } } }, { "category": "product_version", "name": "odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "product": { "name": "odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "product_id": "odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "product_identification_helper": { "purl": "pkg:oci/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/odr-rhel9-operator\u0026tag=v4.13.0-33" } } }, { "category": "product_version", "name": "odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le", "product": { "name": "odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le", "product_id": "odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le", "product_identification_helper": { "purl": "pkg:oci/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0?arch=ppc64le\u0026repository_url=registry.redhat.io/odf4/rook-ceph-rhel9-operator\u0026tag=v4.13.0-70" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "product": { "name": "odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "product_id": "odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "product_identification_helper": { "purl": "pkg:oci/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749?arch=s390x\u0026repository_url=registry.redhat.io/odf4/cephcsi-rhel9\u0026tag=v4.13.0-35" } } }, { "category": "product_version", "name": "odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "product": { "name": "odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "product_id": "odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "product_identification_helper": { "purl": "pkg:oci/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde?arch=s390x\u0026repository_url=registry.redhat.io/odf4/mcg-cli-rhel9\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "product": { "name": "odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "product_id": "odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2?arch=s390x\u0026repository_url=registry.redhat.io/odf4/mcg-core-rhel9\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "product": { "name": "odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "product_id": "odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "product_identification_helper": { "purl": "pkg:oci/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296?arch=s390x\u0026repository_url=registry.redhat.io/odf4/mcg-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "product": { "name": "odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "product_id": "odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "product_identification_helper": { "purl": "pkg:oci/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316?arch=s390x\u0026repository_url=registry.redhat.io/odf4/mcg-rhel9-operator\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "product": { "name": "odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "product_id": "odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362?arch=s390x\u0026repository_url=registry.redhat.io/odf4/ocs-client-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "product": { "name": "odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "product_id": "odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90?arch=s390x\u0026repository_url=registry.redhat.io/odf4/ocs-client-rhel9-operator\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "product": { "name": "odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "product_id": "odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57?arch=s390x\u0026repository_url=registry.redhat.io/odf4/ocs-metrics-exporter-rhel9\u0026tag=v4.13.0-78" } } }, { "category": "product_version", "name": "odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "product": { "name": "odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "product_id": "odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0?arch=s390x\u0026repository_url=registry.redhat.io/odf4/ocs-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "product": { "name": "odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "product_id": "odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "product_identification_helper": { "purl": "pkg:oci/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4?arch=s390x\u0026repository_url=registry.redhat.io/odf4/ocs-rhel9-operator\u0026tag=v4.13.0-67" } } }, { "category": "product_version", "name": "odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "product": { "name": "odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "product_id": "odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-console-rhel9\u0026tag=v4.13.0-85" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "product": { "name": "odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "product_id": "odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "product": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "product_id": "odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "product": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "product_id": "odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "product": { "name": "odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "product_id": "odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-console-rhel9\u0026tag=v4.13.0-81" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "product": { "name": "odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "product_id": "odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "product": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "product_id": "odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "product": { "name": "odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "product_id": "odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-must-gather-rhel9\u0026tag=v4.13.0-35" } } }, { "category": "product_version", "name": "odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "product": { "name": "odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "product_id": "odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "product": { "name": "odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "product_id": "odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "product_identification_helper": { "purl": "pkg:oci/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odf-rhel9-operator\u0026tag=v4.13.0-24" } } }, { "category": "product_version", "name": "odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "product": { "name": "odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "product_id": "odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "product_identification_helper": { "purl": "pkg:oci/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odr-cluster-operator-bundle\u0026tag=v4.13.0-218" } } }, { "category": "product_version", "name": "odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "product": { "name": "odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "product_id": "odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "product_identification_helper": { "purl": "pkg:oci/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odr-hub-operator-bundle\u0026tag=v4.13.0-217" } } }, { "category": "product_version", "name": "odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "product": { "name": "odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "product_id": "odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "product_identification_helper": { "purl": "pkg:oci/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317?arch=s390x\u0026repository_url=registry.redhat.io/odf4/odr-rhel9-operator\u0026tag=v4.13.0-33" } } }, { "category": "product_version", "name": "odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "product": { "name": "odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "product_id": "odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "product_identification_helper": { "purl": "pkg:oci/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f?arch=s390x\u0026repository_url=registry.redhat.io/odf4/rook-ceph-rhel9-operator\u0026tag=v4.13.0-70" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "product": { "name": "odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "product_id": "odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "product_identification_helper": { "purl": "pkg:oci/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549?arch=arm64\u0026repository_url=registry.redhat.io/odf4/mcg-cli-rhel9\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "product": { "name": "odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "product_id": "odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0?arch=arm64\u0026repository_url=registry.redhat.io/odf4/mcg-core-rhel9\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "product": { "name": "odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "product_id": "odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "product_identification_helper": { "purl": "pkg:oci/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac?arch=arm64\u0026repository_url=registry.redhat.io/odf4/mcg-rhel9-operator\u0026tag=v4.13.0-41" } } }, { "category": "product_version", "name": "odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "product": { "name": "odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "product_id": "odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "product_identification_helper": { "purl": "pkg:oci/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990?arch=arm64\u0026repository_url=registry.redhat.io/odf4/ocs-client-rhel9-operator\u0026tag=v4.13.0-17" } } }, { "category": "product_version", "name": "odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "product": { "name": "odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "product_id": "odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "product_identification_helper": { "purl": "pkg:oci/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d?arch=arm64\u0026repository_url=registry.redhat.io/odf4/ocs-rhel9-operator\u0026tag=v4.13.0-67" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "product": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "product_id": "odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b?arch=arm64\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "product": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "product_id": "odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "product_identification_helper": { "purl": "pkg:oci/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684?arch=arm64\u0026repository_url=registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "product": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "product_id": "odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee?arch=arm64\u0026repository_url=registry.redhat.io/odf4/odf-multicluster-rhel9-operator\u0026tag=v4.13.0-18" } } }, { "category": "product_version", "name": "odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "product": { "name": "odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "product_id": "odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "product_identification_helper": { "purl": "pkg:oci/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68?arch=arm64\u0026repository_url=registry.redhat.io/odf4/odf-must-gather-rhel9\u0026tag=v4.13.0-35" } } }, { "category": "product_version", "name": "odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "product": { "name": "odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "product_id": "odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "product_identification_helper": { "purl": "pkg:oci/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396?arch=arm64\u0026repository_url=registry.redhat.io/odf4/odf-rhel9-operator\u0026tag=v4.13.0-24" } } }, { "category": "product_version", "name": "odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "product": { "name": "odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "product_id": "odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "product_identification_helper": { "purl": "pkg:oci/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d?arch=arm64\u0026repository_url=registry.redhat.io/odf4/odr-rhel9-operator\u0026tag=v4.13.0-33" } } } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64" }, "product_reference": "odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x" }, "product_reference": "odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le" }, "product_reference": "odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64" }, "product_reference": "odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64" }, "product_reference": "odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x" }, "product_reference": "odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le" }, "product_reference": "odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le" }, "product_reference": "odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x" }, "product_reference": "odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64" }, "product_reference": "odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" }, "product_reference": "odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le" }, "product_reference": "odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x" }, "product_reference": "odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64" }, "product_reference": "odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64" }, "product_reference": "odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x" }, "product_reference": "odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64" }, "product_reference": "odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" }, "product_reference": "odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x" }, "product_reference": "odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64" }, "product_reference": "odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le" }, "product_reference": "odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x" }, "product_reference": "odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64" }, "product_reference": "odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le" }, "product_reference": "odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64" }, "product_reference": "odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64" }, "product_reference": "odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le" }, "product_reference": "odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x" }, "product_reference": "odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le" }, "product_reference": "odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x" }, "product_reference": "odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64" }, "product_reference": "odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64" }, "product_reference": "odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64" }, "product_reference": "odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x" }, "product_reference": "odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le" }, "product_reference": "odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64" }, "product_reference": "odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le" }, "product_reference": "odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x" }, "product_reference": "odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le" }, "product_reference": "odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64" }, "product_reference": "odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x" }, "product_reference": "odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le" }, "product_reference": "odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x" }, "product_reference": "odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64" }, "product_reference": "odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64" }, "product_reference": "odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x" }, "product_reference": "odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64" }, "product_reference": "odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le" }, "product_reference": "odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64" }, "product_reference": "odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64" }, "product_reference": "odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le" }, "product_reference": "odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x" }, "product_reference": "odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le" }, "product_reference": "odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x" }, "product_reference": "odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64" }, "product_reference": "odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64" }, "product_reference": "odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64" }, "product_reference": "odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x" }, "product_reference": "odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le" }, "product_reference": "odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64" }, "product_reference": "odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64" }, "product_reference": "odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x" }, "product_reference": "odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le" }, "product_reference": "odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le" }, "product_reference": "odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x" }, "product_reference": "odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64" }, "product_reference": "odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x" }, "product_reference": "odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64" }, "product_reference": "odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64" }, "product_reference": "odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" }, "product_reference": "odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64" }, "product_reference": "odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x" }, "product_reference": "odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le" }, "product_reference": "odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64" }, "product_reference": "odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x" }, "product_reference": "odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le" }, "product_reference": "odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le" }, "product_reference": "odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64" }, "product_reference": "odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64" }, "product_reference": "odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" }, "product_reference": "odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x" }, "product_reference": "odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64 as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64" }, "product_reference": "odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "relates_to_product_reference": "9Base-RHODF-4.13" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le as a component of RHODF 4.13 for RHEL 9", "product_id": "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" }, "product_reference": "odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le", "relates_to_product_reference": "9Base-RHODF-4.13" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-16250", "cwe": { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" }, "discovery_date": "2023-02-06T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2167337" } ], "notes": [ { "category": "description", "text": "A flaw was found in Vault and Vault Enterprise (\u201cVault\u201d). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulated and bypass authentication.", "title": "Vulnerability description" }, { "category": "summary", "text": "vault: Hashicorp Vault AWS IAM Integration Authentication Bypass", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-16250" }, { "category": "external", "summary": "RHBZ#2167337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167337" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-16250", "url": "https://www.cve.org/CVERecord?id=CVE-2020-16250" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-16250", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16250" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2020-16-vault-s-aws-auth-method-allows-authentication-bypass/18101", "url": "https://discuss.hashicorp.com/t/hcsec-2020-16-vault-s-aws-auth-method-allows-authentication-bypass/18101" } ], "release_date": "2020-08-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vault: Hashicorp Vault AWS IAM Integration Authentication Bypass" }, { "cve": "CVE-2020-16251", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "discovery_date": "2023-02-06T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2167340" } ], "notes": [ { "category": "description", "text": "A flaw was found in Vault and Vault Enterprise (\u201cVault\u201d). In affected versions of Vault, with the GCP Auth Method configured and under certain circumstances, the values relied upon by Vault to validate Google Compute Engine (GCE) VMs may be manipulated and bypass authentication.", "title": "Vulnerability description" }, { "category": "summary", "text": "vault: GCP Auth Method Allows Authentication Bypass", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-16251" }, { "category": "external", "summary": "RHBZ#2167340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2167340" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-16251", "url": "https://www.cve.org/CVERecord?id=CVE-2020-16251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-16251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16251" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2020-17-vault-s-gcp-auth-method-allows-authentication-bypass/18102", "url": "https://discuss.hashicorp.com/t/hcsec-2020-17-vault-s-gcp-auth-method-allows-authentication-bypass/18102" } ], "release_date": "2020-08-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vault: GCP Auth Method Allows Authentication Bypass" }, { "cve": "CVE-2021-3765", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-09-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126299" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the validator package. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "validator: Inefficient Regular Expression Complexity in Validator.js", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3765" }, { "category": "external", "summary": "RHBZ#2126299", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126299" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3765", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3765" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765" }, { "category": "external", "summary": "https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9", "url": "https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9" } ], "release_date": "2021-11-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "validator: Inefficient Regular Expression Complexity in Validator.js" }, { "cve": "CVE-2021-3807", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2007557" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw requires crafted invalid ANSI escape codes in order to be exploited and only allows for denial of service of applications on the client side, hence the impact has been rated as Moderate.\n\nIn Red Hat Virtualization and Red Hat Quay some components use a vulnerable version of ansi-regex. However, all frontend code is executed on the client side. As the maximum impact of this vulnerability is denial of service in the client, the vulnerability is rated Moderate for those products.\n\nOpenShift Container Platform 4 (OCP) ships affected version of ansi-regex in the ose-metering-hadoop container, however the metering operator is deprecated since 4.6[1]. This issue is not currently planned to be addressed in future updates and hence hadoop container has been marked as \u0027will not fix\u0027.\n\nAdvanced Cluster Management for Kubernetes (RHACM) ships the affected version of ansi-regex in several containers, however the impact of this vulnerability is deemed low as it would result in an authenticated slowing down their own user interface. \n\n[1] https://docs.openshift.com/container-platform/4.6/metering/metering-about-metering.html", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3807" }, { "category": "external", "summary": "RHBZ#2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3807", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807" }, { "category": "external", "summary": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994", "url": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994" } ], "release_date": "2021-09-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes" }, { "cve": "CVE-2021-4235", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156727" } ], "notes": [ { "category": "description", "text": "A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.", "title": "Vulnerability description" }, { "category": "summary", "text": "go-yaml: Denial of Service in go-yaml", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-4235" }, { "category": "external", "summary": "RHBZ#2156727", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156727" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4235", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4235" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4235", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4235" }, { "category": "external", "summary": "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241", "url": "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241" }, { "category": "external", "summary": "https://github.com/go-yaml/yaml/pull/375", "url": "https://github.com/go-yaml/yaml/pull/375" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2021-0061", "url": "https://pkg.go.dev/vuln/GO-2021-0061" } ], "release_date": "2022-12-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "go-yaml: Denial of Service in go-yaml" }, { "cve": "CVE-2021-4238", "cwe": { "id": "CWE-331", "name": "Insufficient Entropy" }, "discovery_date": "2022-12-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156729" } ], "notes": [ { "category": "description", "text": "A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issue significantly reduces the amount of entropy generated in short strings by these functions.", "title": "Vulnerability description" }, { "category": "summary", "text": "goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-4238" }, { "category": "external", "summary": "RHBZ#2156729", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156729" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4238", "url": "https://www.cve.org/CVERecord?id=CVE-2021-4238" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4238", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4238" }, { "category": "external", "summary": "https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1", "url": "https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-3839-6r69-m497", "url": "https://github.com/advisories/GHSA-3839-6r69-m497" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2022-0411", "url": "https://pkg.go.dev/vuln/GO-2022-0411" } ], "release_date": "2022-12-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be" }, { "cve": "CVE-2021-43998", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2021-11-30T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2028193" } ], "notes": [ { "category": "description", "text": "A flaw was found in HashiCorp Vault. In affected versions of HashiCorp Vault and Vault Enterprise, templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement.", "title": "Vulnerability description" }, { "category": "summary", "text": "vault: incorrect policy enforcement", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-43998" }, { "category": "external", "summary": "RHBZ#2028193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2028193" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-43998", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43998" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-43998", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43998" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132", "url": "https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132" } ], "release_date": "2021-11-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vault: incorrect policy enforcement" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "acknowledgments": [ { "names": [ "Adam Korczynski" ], "organization": "ADA Logics" }, { "names": [ "OSS-Fuzz" ] } ], "cve": "CVE-2022-2879", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2022-10-07T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2132867" } ], "notes": [ { "category": "description", "text": "A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: archive/tar: unbounded memory consumption when reading headers", "title": "Vulnerability summary" }, { "category": "other", "text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2879" }, { "category": "external", "summary": "RHBZ#2132867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132867" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2879", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2879" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2879", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2879" }, { "category": "external", "summary": "https://github.com/golang/go/issues/54853", "url": "https://github.com/golang/go/issues/54853" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1", "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1" } ], "release_date": "2022-10-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: archive/tar: unbounded memory consumption when reading headers" }, { "acknowledgments": [ { "names": [ "Daniel Abeles" ], "organization": "Head of Research, Oxeye" }, { "names": [ "Gal Goldstein" ], "organization": "Security Researcher, Oxeye" } ], "cve": "CVE-2022-2880", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-10-07T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2132868" } ], "notes": [ { "category": "description", "text": "A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query parameters in the forwarded query when the outbound request\u0027s form field is set after the reverse proxy. The director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the original query parameters unchanged.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters", "title": "Vulnerability summary" }, { "category": "other", "text": "The opportunity to exploit this vulnerability is limited to the Golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2880" }, { "category": "external", "summary": "RHBZ#2132868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2880", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2880" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2880", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2880" }, { "category": "external", "summary": "https://github.com/golang/go/issues/54663", "url": "https://github.com/golang/go/issues/54663" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1", "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1" } ], "release_date": "2022-10-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters" }, { "cve": "CVE-2022-3517", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-06-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134609" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimatch: ReDoS via the braceExpand function", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3517" }, { "category": "external", "summary": "RHBZ#2134609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134609" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3517", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517" } ], "release_date": "2022-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimatch: ReDoS via the braceExpand function" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "cve": "CVE-2022-23540", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "discovery_date": "2023-02-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2169378" } ], "notes": [ { "category": "description", "text": "A flaw was found in the jsonwebtoken library. In affected versions of the jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify() function may lead to signature validation bypass due to defaulting to the none algorithm for signature verification.", "title": "Vulnerability description" }, { "category": "summary", "text": "jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-23540" }, { "category": "external", "summary": "RHBZ#2169378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2169378" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23540", "url": "https://www.cve.org/CVERecord?id=CVE-2022-23540" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23540", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23540" }, { "category": "external", "summary": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6", "url": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6" } ], "release_date": "2022-12-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass" }, { "cve": "CVE-2022-23541", "cwe": { "id": "CWE-1259", "name": "Improper Restriction of Security Token Assignment" }, "discovery_date": "2023-02-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2169375" } ], "notes": [ { "category": "description", "text": "A flaw was found in the jsonwebtoken library. Affected versions of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function will result in incorrect verification of tokens. Using a different algorithm and key combination in verification than what was used to sign the tokens, specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to the successful validation of forged tokens.", "title": "Vulnerability description" }, { "category": "summary", "text": "jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-23541" }, { "category": "external", "summary": "RHBZ#2169375", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2169375" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23541", "url": "https://www.cve.org/CVERecord?id=CVE-2022-23541" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23541", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23541" }, { "category": "external", "summary": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959", "url": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959" } ], "release_date": "2022-12-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC" }, { "cve": "CVE-2022-27664", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-06T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2124669" } ], "notes": [ { "category": "description", "text": "A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http: handle server errors after sending GOAWAY", "title": "Vulnerability summary" }, { "category": "other", "text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-27664" }, { "category": "external", "summary": "RHBZ#2124669", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124669" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-27664", "url": "https://www.cve.org/CVERecord?id=CVE-2022-27664" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664" }, { "category": "external", "summary": "https://go.dev/issue/54658", "url": "https://go.dev/issue/54658" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ", "url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ" } ], "release_date": "2022-09-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http: handle server errors after sending GOAWAY" }, { "cve": "CVE-2022-30635", "cwe": { "id": "CWE-1325", "name": "Improperly Controlled Sequential Memory Allocation" }, "discovery_date": "2022-07-14T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2107388" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: encoding/gob: stack exhaustion in Decoder.Decode", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform (OCP) starting from 4.10 stream is already compiled in the patched version of Go, hence is not affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30635" }, { "category": "external", "summary": "RHBZ#2107388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2107388" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30635", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30635" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30635", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30635" }, { "category": "external", "summary": "https://go.dev/issue/53615", "url": "https://go.dev/issue/53615" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE", "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE" } ], "release_date": "2022-07-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: encoding/gob: stack exhaustion in Decoder.Decode" }, { "cve": "CVE-2022-32189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-08-02T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2113814" } ], "notes": [ { "category": "description", "text": "An uncontrolled resource consumption flaw was found in Golang math/big. A too-short encoded message can cause a panic in Float.GobDecode and Rat.GobDecode in math/big in Go, potentially allowing an attacker to create a denial of service, impacting availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw stems from a particular and specific method (GoBDecode) which isn\u0027t commonly used. There are few components within Red Hat offerings which call this function. In rare cases where this method is called, the component limits possible damage or it is not possible to be triggered by an attacker. For these combined reasons the impact has been downgraded to Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-32189" }, { "category": "external", "summary": "RHBZ#2113814", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2113814" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-32189", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32189" }, { "category": "external", "summary": "https://go.dev/issue/53871", "url": "https://go.dev/issue/53871" }, { "category": "external", "summary": "https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU", "url": "https://groups.google.com/g/golang-nuts/c/DCFSyTGM0wU" } ], "release_date": "2022-08-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service" }, { "cve": "CVE-2022-32190", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-09-06T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2124668" } ], "notes": [ { "category": "description", "text": "A flaw was found in the golang package. The JoinPath doesn\u0027t remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/url: JoinPath does not strip relative path components in all circumstances", "title": "Vulnerability summary" }, { "category": "other", "text": "The vulnerable functions, JoinPath and URL.JoinPath was introduced in upstream go1.19, whereas, RHEL ships go1.17 and go1.18 versions, which does not contain the vulnerable code. Hence, packages shipped with RHEL-8, RHEL-9 are not affected.\n\nAll Y stream releases of OpenShift Container Platform 4 run on RHEL-8 or RHEL-9, so OCP 4 is also not affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-32190" }, { "category": "external", "summary": "RHBZ#2124668", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124668" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-32190", "url": "https://www.cve.org/CVERecord?id=CVE-2022-32190" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-32190", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32190" }, { "category": "external", "summary": "https://go.dev/issue/54385", "url": "https://go.dev/issue/54385" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ", "url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ" } ], "release_date": "2022-09-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/url: JoinPath does not strip relative path components in all circumstances" }, { "cve": "CVE-2022-38149", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2022-08-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119551" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the HashiCorp Consul Template. This issue may reveal the contents of a Vault secret when used with an invalid template.", "title": "Vulnerability description" }, { "category": "summary", "text": "consul: Consul Template May Expose Vault Secrets When Processing Invalid Input", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38149" }, { "category": "external", "summary": "RHBZ#2119551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119551" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38149" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215", "url": "https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215" } ], "release_date": "2022-08-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "consul: Consul Template May Expose Vault Secrets When Processing Invalid Input" }, { "cve": "CVE-2022-38900", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-02-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2170644" } ], "notes": [ { "category": "description", "text": "A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "decode-uri-component: improper input validation resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "For OpenShift Container Platform (OCP), Advanced Clusters Management for Kubernetes (ACM) and Advanced Cluster Security (ACS), the NPM decode-uri-component package is only present in source repositories as a development dependency, it is not used in production. Therefore this vulnerability is rated Low for OCP and ACS.\n\nIn Red Hat OpenShift Logging the openshift-logging/kibana6-rhel8 container bundles many nodejs packages as a build time dependencies, including the decode-uri-component package. \nThe vulnerable code is not used, hence the impact to OpenShift Logging by this vulnerability is Low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38900" }, { "category": "external", "summary": "RHBZ#2170644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2170644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38900", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38900" }, { "category": "external", "summary": "https://github.com/SamVerschueren/decode-uri-component/issues/5", "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq" } ], "release_date": "2022-11-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "decode-uri-component: improper input validation resulting in DoS" }, { "cve": "CVE-2022-41316", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135339" } ], "notes": [ { "category": "description", "text": "A flaw was found in HashiCorp Vault and Vault Enterprise. Vault\u2019s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role\u2019s Certificate Authority (CA) into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved.", "title": "Vulnerability description" }, { "category": "summary", "text": "vault: insufficient certificate revocation list checking", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41316" }, { "category": "external", "summary": "RHBZ#2135339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135339" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41316", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41316" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41316", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41316" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483", "url": "https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483" } ], "release_date": "2022-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vault: insufficient certificate revocation list checking" }, { "acknowledgments": [ { "names": [ "Adam Korczynski" ], "organization": "ADA Logics" }, { "names": [ "OSS-Fuzz" ] } ], "cve": "CVE-2022-41715", "discovery_date": "2022-10-07T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2132872" } ], "notes": [ { "category": "description", "text": "A flaw was found in the golang package, where programs that compile regular expressions from untrusted sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is linear in the input size. Still, in some cases, the constant factor can be as high as 40,000, making a relatively small regexp consume larger amounts of memory. After the fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Routine use of regular expressions is unaffected.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: regexp/syntax: limit memory used by parsing regexps", "title": "Vulnerability summary" }, { "category": "other", "text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41715" }, { "category": "external", "summary": "RHBZ#2132872", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41715", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41715" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41715", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41715" }, { "category": "external", "summary": "https://github.com/golang/go/issues/55949", "url": "https://github.com/golang/go/issues/55949" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1", "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1" } ], "release_date": "2022-10-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: regexp/syntax: limit memory used by parsing regexps" }, { "cve": "CVE-2022-41717", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-01-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2161274" } ], "notes": [ { "category": "description", "text": "A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Within Red Hat OpenShift Container Platform, the grafana container is listed as will not fix. Since OCP 4.10, Grafana itself is not shipped and the Grafana web server is protected behind an OAuth proxy server.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41717" }, { "category": "external", "summary": "RHBZ#2161274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41717", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41717" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717" }, { "category": "external", "summary": "https://go.dev/cl/455635", "url": "https://go.dev/cl/455635" }, { "category": "external", "summary": "https://go.dev/cl/455717", "url": "https://go.dev/cl/455717" }, { "category": "external", "summary": "https://go.dev/issue/56350", "url": "https://go.dev/issue/56350" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ", "url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2022-1144", "url": "https://pkg.go.dev/vuln/GO-2022-1144" } ], "release_date": "2022-11-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests" }, { "acknowledgments": [ { "names": [ "Philippe Antoine" ], "organization": "Catena Cyber" } ], "cve": "CVE-2022-41723", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-14T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2178358" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding", "title": "Vulnerability summary" }, { "category": "other", "text": "Within OpenShift Container Platform, the maximum impact of this vulnerability is a denial of service against an individual container so the impact could not cascade across the entire infrastructure, this vulnerability is rated Moderate impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41723" }, { "category": "external", "summary": "RHBZ#2178358", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178358" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41723", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41723" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41723" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h", "url": "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h" }, { "category": "external", "summary": "https://go.dev/cl/468135", "url": "https://go.dev/cl/468135" }, { "category": "external", "summary": "https://go.dev/cl/468295", "url": "https://go.dev/cl/468295" }, { "category": "external", "summary": "https://go.dev/issue/57855", "url": "https://go.dev/issue/57855" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1571", "url": "https://pkg.go.dev/vuln/GO-2023-1571" }, { "category": "external", "summary": "https://vuln.go.dev/ID/GO-2023-1571.json", "url": "https://vuln.go.dev/ID/GO-2023-1571.json" } ], "release_date": "2023-02-17T14:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding" }, { "cve": "CVE-2022-41724", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2178492" } ], "notes": [ { "category": "description", "text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker can cause a denial of service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: crypto/tls: large handshake records may cause panics", "title": "Vulnerability summary" }, { "category": "other", "text": "The opportunity for a denial of service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41724" }, { "category": "external", "summary": "RHBZ#2178492", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178492" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41724", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41724" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41724", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41724" }, { "category": "external", "summary": "https://go.dev/cl/468125", "url": "https://go.dev/cl/468125" }, { "category": "external", "summary": "https://go.dev/issue/58001", "url": "https://go.dev/issue/58001" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1570", "url": "https://pkg.go.dev/vuln/GO-2023-1570" } ], "release_date": "2023-02-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: crypto/tls: large handshake records may cause panics" }, { "cve": "CVE-2022-41725", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2178488" } ], "notes": [ { "category": "description", "text": "A flaw was found in Go, where it is vulnerable to a denial of service caused by an excessive resource consumption flaw in the net/http and mime/multipart packages. By sending a specially-crafted request, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http, mime/multipart: denial of service from excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "The opportunity for a Denial of Service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang\u2019s Garbage Collector; OpenShift\u2019s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41725" }, { "category": "external", "summary": "RHBZ#2178488", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178488" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41725", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41725" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41725", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41725" }, { "category": "external", "summary": "https://go.dev/cl/468124", "url": "https://go.dev/cl/468124" }, { "category": "external", "summary": "https://go.dev/issue/58006", "url": "https://go.dev/issue/58006" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1569", "url": "https://pkg.go.dev/vuln/GO-2023-1569" } ], "release_date": "2023-02-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http, mime/multipart: denial of service from excessive resource consumption" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2023-0620", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)" }, "discovery_date": "2023-04-05T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2184663" } ], "notes": [ { "category": "description", "text": "A flaw was found in HashiCorp Vault and Vault Enterprise, which are vulnerable to SQL injection. This flaw allows a local authenticated attacker to send specially-crafted SQL statements to the Microsoft SQL (MSSQL) Database Storage Backend, which could allow the attacker to view, add, modify, or delete information in the backend database.", "title": "Vulnerability description" }, { "category": "summary", "text": "vault: Vault\u2019s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0620" }, { "category": "external", "summary": "RHBZ#2184663", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184663" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0620", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0620" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0620", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0620" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080", "url": "https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080" } ], "release_date": "2023-03-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vault: Vault\u2019s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File" }, { "cve": "CVE-2023-0665", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "discovery_date": "2023-03-30T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182981" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Hashicorp vault. Vault\u2019s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in a denial of service of the PKI mount. This bug did not affect public or private key material, trust chains, or certificate issuance.", "title": "Vulnerability description" }, { "category": "summary", "text": "hashicorp/vault: Vault\u2019s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0665" }, { "category": "external", "summary": "RHBZ#2182981", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182981" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0665", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0665" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0665", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0665" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1", "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1" } ], "release_date": "2023-03-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "hashicorp/vault: Vault\u2019s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata" }, { "cve": "CVE-2023-24999", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2023-03-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2177844" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Hashicorp vault. When using the Vault and Vault Enterprise approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of another role by providing the secret ID accessor.", "title": "Vulnerability description" }, { "category": "summary", "text": "Hashicorp/vault: Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-24999" }, { "category": "external", "summary": "RHBZ#2177844", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177844" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24999", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24999" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24999", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24999" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305", "url": "https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305" } ], "release_date": "2023-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Hashicorp/vault: Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation" }, { "cve": "CVE-2023-25000", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2023-03-30T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182972" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Hashicorp vault. This flaw allows an attacker with access to and the ability to observe a large number of unseal operations on the host through a side channel to reduce the search space of a brute-force effort to recover the Shamir shares.", "title": "Vulnerability description" }, { "category": "summary", "text": "hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "known_not_affected": [ "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:069d8bdcaa6ddc628f115d6ec3f3e851e06d4274594d9cd3cd567e574ba1baed_amd64", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:3cc3dfbc6d6227a4085ffc5bef9dab0702e7d2096ad782b6b0c9c002f1e60749_s390x", "9Base-RHODF-4.13:odf4/cephcsi-rhel9@sha256:e1af0b5bc33688e5ca9c209658dd44285f4d1707e0c165a7c6a7f4934006f5f9_ppc64le", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:05955b12d9597865f21a2fce097eecaf16218d1b2a3147fbdd0fe0199f792549_arm64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:357598ae9ea1314a29e9321aff303c36002b499e6474e14ae58ed63290a76f55_amd64", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:861762b4a8aa19ed2ece5d1b48a2aea137dbba2b03af40570bdb60ceda426dde_s390x", "9Base-RHODF-4.13:odf4/mcg-cli-rhel9@sha256:945ca7475dff23abc318af69b9513b9412f3b8b3498fbeb8c59c114c5fdeea2c_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:1f4994c5fa092afb665c3b63a8691ba5b15702f83fbd1e4ac70eb1803f6f68f2_ppc64le", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:5d0ab671d71e1d6307836a05e0a9f14bb260277f646dc63252291b12921473c2_s390x", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:862a2ab41511a86c7e7ee1f0538736b78e49035f3e8fb6d8e801608b913c2826_amd64", "9Base-RHODF-4.13:odf4/mcg-core-rhel9@sha256:f37b4f0598d46dd8ca2183ea52d52e96163f71666617a98c671100a705be2cb0_arm64", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:1e1adf4e3f3766f183daf98ff88de7dbb76cd000a81ac2e698ca74e9e0f2c0e6_ppc64le", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:d5bea64dc86eee978b678c6d47d855568b97a18c9c5c3e5998f0ca36f945a296_s390x", "9Base-RHODF-4.13:odf4/mcg-operator-bundle@sha256:ebfd21cd14efd7c95d53c8f3b939e4e8167ae9aed8ad12ce1985a3d09e2a51be_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:5143db374ccea9fe2a7ca95b1bc655c403509faff7e42b8c672767bc2863418e_amd64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:a2e6602ddc468c91df80eeb06e0dff4dc1fa509b4b68de43be466b9bd1a90316_s390x", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e05c0308d1008f447f87bdea4b23ef56e98d27cd6845c261f5d31cb9cdbb46ac_arm64", "9Base-RHODF-4.13:odf4/mcg-rhel9-operator@sha256:e7e47e90eba427843513e2bc868d4ae3f0816db9847ddec4f96a6f41cd0769ab_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:150eea388a6ede971105b485c52ed4cbd4d3f0c8dffa32bf09d08b542e109362_s390x", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:4c595ee2b908460180617dba1057fab5e48d8ddd07d434948ebbd9232bec80de_amd64", "9Base-RHODF-4.13:odf4/ocs-client-operator-bundle@sha256:fdeab34e65c61763315f4a3ce0d8a092c825589f58ea4d9e320a2376955023bf_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:3258ec9716f45b3428352cc3510d6d8b3ca41ed75fd1a81cd61275249d3fef90_s390x", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:9e67b060718c891f53d000f0899006f226d703de63b6feede42ea45df9686b64_amd64", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:d89f084da3f8d145b1e5e9e4d0dc63994c06422b6df92c9efac0e162fd8610b2_ppc64le", "9Base-RHODF-4.13:odf4/ocs-client-rhel9-operator@sha256:e692d480075469adeb6fbec1d08121fadaedcde7950e5a2dfdfb6024e38d8990_arm64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:2d6cdbf994a9bd03e80b8fba39d6d4b033622615c543ff0300ee960508ae07aa_amd64", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:7d1c503d9f48a8efec3f06aa3deb28144a888c88f1bb3beeeb2465ae58b5e394_ppc64le", "9Base-RHODF-4.13:odf4/ocs-metrics-exporter-rhel9@sha256:c5a5c9515f2b2564ecd718886f2e27ec54402d29ea4bf6e1ad33f63eb0bd9d57_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:24bc40a30a9c0731ac718374fdae5b7e1c45f103495294245d704ca0f69f35df_ppc64le", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:9ae5f567047c26d7ebb36c53c304f402b03c276923621e3dd51d35d1b4b0e0d0_s390x", "9Base-RHODF-4.13:odf4/ocs-operator-bundle@sha256:b44f5fbf874ea565d566c7a149e0be4333d07d1c896dba9aa0a308a35e990e41_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:4610b8989b6fae91da065da2a50f661dd044ea22452372c4321f74a935c6de7c_amd64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:64aa10ced42edb3481d94d62261f56fa991220e9eeec7b142fda6b95a5c2d69d_arm64", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:d67c7a2032a92737c0f9ab9ff2f181b3e15d53203bd4cbb6eef9b3d9655631e4_s390x", "9Base-RHODF-4.13:odf4/ocs-rhel9-operator@sha256:ec86e82a9fc412e174561fe9f808b05cee716c7e6498498c3b3d32e48d6f19ed_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:97d94bc216b9265135493a262ffcd39a7c5f9f67cdcac39c0a7c4378ded420b9_amd64", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:b0981a245672d2f918cad4d5e4a43f1fdd403d446e3f890de18b0dc71141dc1c_ppc64le", "9Base-RHODF-4.13:odf4/odf-console-rhel9@sha256:d13cad8671f69122e33afde5e53b0a9e0728fbfac2df3e981b14bc57b990f210_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:23c631bed1bca5a339c63032bf4b02edb27f0f0d15a81de66208dd7328a22f6b_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:531016e1b8d56e49130ef8a9610223142c0410b41c7e099d5fa08289afa99306_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-operator-bundle@sha256:e3265779c83c26832c898c9f64ec1287a8e63a32433a8303b8e3952e008a3ae9_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:328ebea8a0577b3b3f5df2ddfda109134350f700ccde362834ca4aa88614cde8_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:841ce1cde9d230458bd071fa943ebfc3dda29fc0e63ebabd2dad8bdd055acfa0_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:a8f28a0c576d5eabfa1b11cb3ca94cfaca7d295a3f419f3557a0d9cbb6f91135_amd64", "9Base-RHODF-4.13:odf4/odf-csi-addons-rhel9-operator@sha256:fb35cb085e41eabcc8d8a8cb5b9981968361642f1d15a011d537f7422a2c832b_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:10884ba2e3e9b44fa49347567caa01966578ac3ca45d50a37e0650a98aa095e6_s390x", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:16af2c689218d80e450101428796ecbbef331bfbb9153eb328670477284a2684_arm64", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:3785b04c0d5464eb4514bd3b98e59b2b39815a58e0afc2730104e4e69613ad87_ppc64le", "9Base-RHODF-4.13:odf4/odf-csi-addons-sidecar-rhel9@sha256:eada63799fc6cb128d2a05a2324700500e1ea2f0dc573899832782ef568ce2a9_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:1225db4ef5dd45e5886949babd7db2b5679be927e3a5324d1d0737ba7be96aa3_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:4043076d1e3cdb560ef5ad4b4f06a911590105e655c34d083751be9b1f070423_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-console-rhel9@sha256:889eb0d94a9a573e42d04e4edbd97a389d74157c94bee674df17b2184de1fcde_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:33c136b3d0e5ed8d4fb781566c2bac3cdc01c30e0351035bf962f35203af87a2_ppc64le", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:593cf98fc32b66381bd7e324c89b0a21b7ffec63541bb403b900121d712237f9_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-operator-bundle@sha256:caa3e66684c046b1a4ce3fdc1d617b65fcc78a330268069a9cc02e071501c482_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:1635e20f43a11759364b2ab5a52c5cee9cd2bc141888b6857f3e3703b90e8eee_arm64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:811dfbb10cd4012b8765d751d52c44b40469bf4758cd284b8edf6093cb7123a2_amd64", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:a6dbf5d5d116661fd99348452bbb89458a7cf9326ff64aea285dcb4b0a9893cf_s390x", "9Base-RHODF-4.13:odf4/odf-multicluster-rhel9-operator@sha256:f67f2ba7c47e14c493d22a500423c92b0cc01f8d9570aa3f51a0cb1957f836af_ppc64le", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:a42dd93af9e17fe4af792ccc4c92487f33bf38e1642e21f8e86e23fa86e78a68_arm64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:b64b3f6b1e423e2fcc5c9af6434c8bf0c03498070379b948d82eced1d3b94cbf_amd64", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:dd3eddf1183c67b1011f35f15b85fd5998edb1812852a3b51f1c2971d5155870_s390x", "9Base-RHODF-4.13:odf4/odf-must-gather-rhel9@sha256:e657739355245310c8182c682bc003ce0d3d6abac6115c34a9ca7ffaf8983ade_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:11849f9242099ab4a4b16c6160f23a8a460d41146e2a3e850e7299ab3fd13f04_ppc64le", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:31c6af39b67cb39bfe954cee68825094198d12c7f14542ca284ed609c40b32e8_s390x", "9Base-RHODF-4.13:odf4/odf-operator-bundle@sha256:64c9d563c9c5e193325f923844b676faa3bbe5c0657b7dee743e03b29c018cef_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:0b5657e09bc199379108afec4b858f1dc2289e705e2e14d383fc3ddaa307c6bf_amd64", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:b284b72288e596677427b6ac51fb142fe6b84f5c3b6f43d395bc403643c443cf_s390x", "9Base-RHODF-4.13:odf4/odr-cluster-operator-bundle@sha256:fe5ccee2ea5902cef3f8c9a94fb9be9516013cc7376e088710fef4a85310db9f_ppc64le", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:0699f1e80453ed3a9bff43c3e431ddd786dafd2f166b62b94f18dc77f4467b25_amd64", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:3d438d91ac261b77075da23d9d08dd603fdbc99aa2c1d4c50681feea5dcfbbc1_s390x", "9Base-RHODF-4.13:odf4/odr-hub-operator-bundle@sha256:51d49bd086645a17b80c40e800d88b0a818de8f5ddc1814f6dc23102da920eb2_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:3d26a840d8a42838bb8bc3ba51cac65f3a502450644e30e9331ea08d805c1ec1_ppc64le", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:4c5294036e2e5e0afc6a177d5172e85bcb347b0f4a71ce48847834e677047615_amd64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:cc99437c3b06b4bf307f36ebf533bdbd3721c43035044a972d69258b9414555d_arm64", "9Base-RHODF-4.13:odf4/odr-rhel9-operator@sha256:dff514a42676f68e0faef651dd14ca91fd8a21f4911c7525fbfa965b748d6317_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-25000" }, { "category": "external", "summary": "RHBZ#2182972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-25000", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25000" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-25000", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25000" }, { "category": "external", "summary": "https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078", "url": "https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078" } ], "release_date": "2023-03-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index\n\nAll Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.", "product_ids": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:3742" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:0564c1165a893f0eea270f636cef8fb9c75704b73bd8ae291a5438122be64484_s390x", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:26663e4d48a70edb4fd100fd86819398ef84da4f9e9da077a4e36deb5c002d9b_amd64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:98ded63b6b4180c52715a6d580afb9b212c4643d53ccc9e00993e2d1bcd41396_arm64", "9Base-RHODF-4.13:odf4/odf-rhel9-operator@sha256:d223f6995bdea0799c8201b658aa81c36ae00188be030012b89d8cda643f4ed8_ppc64le", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:61ec798f3d2bab62b4e56ecba236359e2edd3dd1a7095b839a36530a9b90c98f_s390x", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:9d9289a4b9d4342db67022b0da93249b38f98a499fb6442912528611fde35266_amd64", "9Base-RHODF-4.13:odf4/rook-ceph-rhel9-operator@sha256:c9054d4393cfe4a11e81c5e73f2349c12f315caaabd05a060de0a39effb43bd0_ppc64le" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations" } ] }
rhsa-2022_7830
Vulnerability from csaf_redhat
Published
2022-11-08 11:39
Modified
2024-11-06 01:57
Summary
Red Hat Security Advisory: nodejs:14 security update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:7830", "url": "https://access.redhat.com/errata/RHSA-2022:7830" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7830.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security update", "tracking": { "current_release_date": "2024-11-06T01:57:46+00:00", "generator": { "date": "2024-11-06T01:57:46+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:7830", "initial_release_date": "2022-11-08T11:39:20+00:00", "revision_history": [ { "date": "2022-11-08T11:39:20+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-11-08T11:39:20+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:57:46+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8070020221020110846:bd1311ed", "product": { "name": "nodejs:14:8070020221020110846:bd1311ed", "product_id": "nodejs:14:8070020221020110846:bd1311ed", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8070020221020110846:bd1311ed" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "product": { "name": "nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "product_id": "nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "product": { "name": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "product_id": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.19-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_id": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_id": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_id": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_id": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_id": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "product": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_id": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.20.1.2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "product": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "product_id": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "product": { "name": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "product_id": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.19-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_id": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_id": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_id": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_id": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_id": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_id": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.20.1.2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_id": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_id": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_id": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_id": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_id": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "product": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "product_id": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.20.1.2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_id": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_id": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_id": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_id": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_id": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.20.1-2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64", "product": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_id": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.17-1.14.20.1.2.module%2Bel8.7.0%2B16991%2Bb0a68a3e?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, "product_reference": "nodejs:14:8070020221020110846:bd1311ed", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64" }, "product_reference": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le" }, "product_reference": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x" }, "product_reference": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src" }, "product_reference": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64" }, "product_reference": "nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x" }, "product_reference": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64" }, "product_reference": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x" }, "product_reference": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64" }, "product_reference": "nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64" }, "product_reference": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le" }, "product_reference": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x" }, "product_reference": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64" }, "product_reference": "nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch" }, "product_reference": "nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x" }, "product_reference": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src" }, "product_reference": "nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64" }, "product_reference": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le" }, "product_reference": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x" }, "product_reference": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64 as a component of nodejs:14:8070020221020110846:bd1311ed as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" }, "product_reference": "npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64", "relates_to_product_reference": "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-11-08T11:39:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7830" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-11-08T11:39:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7830" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-11-08T11:39:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7830" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-11-08T11:39:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7830" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" }, { "acknowledgments": [ { "names": [ "VVX7" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-35256", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2022-09-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2130518" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-35256" }, { "category": "external", "summary": "RHBZ#2130518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-35256", "url": "https://www.cve.org/CVERecord?id=CVE-2022-35256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256", "url": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256" } ], "release_date": "2022-09-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-11-08T11:39:20+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:7830" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debuginfo-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-debugsource-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-devel-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-docs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-full-i18n-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.x86_64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-nodemon-0:2.0.19-2.module+el8.7.0+16991+b0a68a3e.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.aarch64", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.ppc64le", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.s390x", "AppStream-8.7.0.Z.MAIN:nodejs:14:8070020221020110846:bd1311ed:npm-1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: HTTP Request Smuggling due to incorrect parsing of header fields" } ] }
rhea-2022_4925
Vulnerability from csaf_redhat
Published
2022-06-07 08:24
Modified
2024-11-05 16:10
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.
Details
Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084654)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084654)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:4925", "url": "https://access.redhat.com/errata/RHEA-2022:4925" }, { "category": "external", "summary": "2084654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084654" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_4925.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-11-05T16:10:34+00:00", "generator": { "date": "2024-11-05T16:10:34+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHEA-2022:4925", "initial_release_date": "2022-06-07T08:24:22+00:00", "revision_history": [ { "date": "2022-06-07T08:24:22+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-07T08:24:22+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T16:10:34+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:8.1::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8010020220518102644:c27ad7f8", "product": { "name": "nodejs:12:8010020220518102644:c27ad7f8", "product_id": "nodejs:12:8010020220518102644:c27ad7f8", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8010020220518102644:c27ad7f8" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "product_id": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, "product_reference": "nodejs:12:8010020220518102644:c27ad7f8", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhea-2022_5221
Vulnerability from csaf_redhat
Published
2022-06-28 07:58
Modified
2024-11-05 16:09
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084653)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084653)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:5221", "url": "https://access.redhat.com/errata/RHEA-2022:5221" }, { "category": "external", "summary": "2084653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084653" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_5221.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-11-05T16:09:35+00:00", "generator": { "date": "2024-11-05T16:09:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHEA-2022:5221", "initial_release_date": "2022-06-28T07:58:19+00:00", "revision_history": [ { "date": "2022-06-28T07:58:19+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-28T07:58:19+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T16:09:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.2::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8020020220523154454:4cda2c84", "product": { "name": "nodejs:12:8020020220523154454:4cda2c84", "product_id": "nodejs:12:8020020220523154454:4cda2c84", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8020020220523154454:4cda2c84" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, "product_reference": "nodejs:12:8020020220523154454:4cda2c84", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhea-2022_5139
Vulnerability from csaf_redhat
Published
2022-06-21 12:40
Modified
2024-11-05 16:09
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.
Details
Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084651)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084651)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:5139", "url": "https://access.redhat.com/errata/RHEA-2022:5139" }, { "category": "external", "summary": "2084651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084651" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_5139.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-11-05T16:09:44+00:00", "generator": { "date": "2024-11-05T16:09:44+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHEA-2022:5139", "initial_release_date": "2022-06-21T12:40:06+00:00", "revision_history": [ { "date": "2022-06-21T12:40:06+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-21T12:40:06+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T16:09:44+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8060020220523160029:ad008a3a", "product": { "name": "nodejs:12:8060020220523160029:ad008a3a", "product_id": "nodejs:12:8060020220523160029:ad008a3a", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8060020220523160029:ad008a3a" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, "product_reference": "nodejs:12:8060020220523160029:ad008a3a", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhea-2022_5615
Vulnerability from csaf_redhat
Published
2022-07-19 21:07
Modified
2024-11-05 16:09
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084652)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084652)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:5615", "url": "https://access.redhat.com/errata/RHEA-2022:5615" }, { "category": "external", "summary": "2084652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084652" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_5615.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-11-05T16:09:27+00:00", "generator": { "date": "2024-11-05T16:09:27+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHEA-2022:5615", "initial_release_date": "2022-07-19T21:07:21+00:00", "revision_history": [ { "date": "2022-07-19T21:07:21+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-07-19T21:07:21+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T16:09:27+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.4::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8040020220523155137:522a0ee4", "product": { "name": "nodejs:12:8040020220523155137:522a0ee4", "product_id": "nodejs:12:8040020220523155137:522a0ee4", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8040020220523155137:522a0ee4" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, "product_reference": "nodejs:12:8040020220523155137:522a0ee4", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
wid-sec-w-2024-0794
Vulnerability from csaf_certbund
Published
2024-04-04 22:00
Modified
2024-04-04 22:00
Summary
Dell ECS: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Dell ECS ist ein Objektspeichersystem.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
Betroffene Betriebssysteme
- Linux
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Dell ECS ist ein Objektspeichersystem.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0794 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0794.json" }, { "category": "self", "summary": "WID-SEC-2024-0794 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0794" }, { "category": "external", "summary": "Dell Security Advisory DSA-2024-141 vom 2024-04-04", "url": "https://www.dell.com/support/kbdoc/000223839/dsa-2024-=" } ], "source_lang": "en-US", "title": "Dell ECS: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-04-04T22:00:00.000+00:00", "generator": { "date": "2024-04-05T09:37:24.604+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0794", "initial_release_date": "2024-04-04T22:00:00.000+00:00", "revision_history": [ { "date": "2024-04-04T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c 3.8.1.0", "product": { "name": "Dell ECS \u003c 3.8.1.0", "product_id": "T033919", "product_identification_helper": { "cpe": "cpe:/h:dell:ecs:3.8.1.0" } } } ], "category": "product_name", "name": "ECS" } ], "category": "vendor", "name": "Dell" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18074", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2018-18074" }, { "cve": "CVE-2020-10663", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-10663" }, { "cve": "CVE-2020-10672", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-10672" }, { "cve": "CVE-2020-10673", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-10673" }, { "cve": "CVE-2020-10735", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-10735" }, { "cve": "CVE-2020-10968", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-10968" }, { "cve": "CVE-2020-10969", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-10969" }, { "cve": "CVE-2020-11111", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-11111" }, { "cve": "CVE-2020-11112", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-11112" }, { "cve": "CVE-2020-11113", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-11113" }, { "cve": "CVE-2020-11612", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-11612" }, { "cve": "CVE-2020-11619", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-11619" }, { "cve": "CVE-2020-11620", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-11620" }, { "cve": "CVE-2020-11979", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-11979" }, { "cve": "CVE-2020-12762", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-12762" }, { "cve": "CVE-2020-12825", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-12825" }, { "cve": "CVE-2020-13956", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-13956" }, { "cve": "CVE-2020-14060", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-14060" }, { "cve": "CVE-2020-14061", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-14061" }, { "cve": "CVE-2020-14062", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-14062" }, { "cve": "CVE-2020-14195", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-14195" }, { "cve": "CVE-2020-15250", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-15250" }, { "cve": "CVE-2020-1945", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-1945" }, { "cve": "CVE-2020-1967", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-1967" }, { "cve": "CVE-2020-1971", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-1971" }, { "cve": "CVE-2020-24616", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-24616" }, { "cve": "CVE-2020-24750", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-24750" }, { "cve": "CVE-2020-25649", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-25649" }, { "cve": "CVE-2020-25658", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-25658" }, { "cve": "CVE-2020-26116", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-26116" }, { "cve": "CVE-2020-26137", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-26137" }, { "cve": "CVE-2020-26541", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-26541" }, { "cve": "CVE-2020-27216", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-27216" }, { "cve": "CVE-2020-27218", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-27218" }, { "cve": "CVE-2020-27223", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-27223" }, { "cve": "CVE-2020-28366", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-28366" }, { "cve": "CVE-2020-28493", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-28493" }, { "cve": "CVE-2020-29509", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-29509" }, { "cve": "CVE-2020-29511", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-29511" }, { "cve": "CVE-2020-29582", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-29582" }, { "cve": "CVE-2020-29651", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-29651" }, { "cve": "CVE-2020-35490", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-35490" }, { "cve": "CVE-2020-35491", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-35491" }, { "cve": "CVE-2020-35728", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-35728" }, { "cve": "CVE-2020-36179", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36179" }, { "cve": "CVE-2020-36180", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36180" }, { "cve": "CVE-2020-36181", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36181" }, { "cve": "CVE-2020-36182", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36182" }, { "cve": "CVE-2020-36183", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36183" }, { "cve": "CVE-2020-36184", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36184" }, { "cve": "CVE-2020-36185", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36185" }, { "cve": "CVE-2020-36186", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36186" }, { "cve": "CVE-2020-36187", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36187" }, { "cve": "CVE-2020-36188", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36188" }, { "cve": "CVE-2020-36189", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36189" }, { "cve": "CVE-2020-36516", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36516" }, { "cve": "CVE-2020-36518", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36518" }, { "cve": "CVE-2020-36557", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36557" }, { "cve": "CVE-2020-36558", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36558" }, { "cve": "CVE-2020-36691", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-36691" }, { "cve": "CVE-2020-7238", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-7238" }, { "cve": "CVE-2020-8840", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-8840" }, { "cve": "CVE-2020-8908", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-8908" }, { "cve": "CVE-2020-8911", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-8911" }, { "cve": "CVE-2020-8912", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-8912" }, { "cve": "CVE-2020-9488", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-9488" }, { "cve": "CVE-2020-9493", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-9493" }, { "cve": "CVE-2020-9546", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-9546" }, { "cve": "CVE-2020-9547", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-9547" }, { "cve": "CVE-2020-9548", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2020-9548" }, { "cve": "CVE-2021-20190", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-20190" }, { "cve": "CVE-2021-20323", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-20323" }, { "cve": "CVE-2021-21290", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-21290" }, { "cve": "CVE-2021-21295", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-21295" }, { "cve": "CVE-2021-21409", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-21409" }, { "cve": "CVE-2021-23840", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-23840" }, { "cve": "CVE-2021-23841", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-23841" }, { "cve": "CVE-2021-2471", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-2471" }, { "cve": "CVE-2021-25642", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-25642" }, { "cve": "CVE-2021-26341", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-26341" }, { "cve": "CVE-2021-27918", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-27918" }, { "cve": "CVE-2021-28153", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-28153" }, { "cve": "CVE-2021-28165", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-28165" }, { "cve": "CVE-2021-28169", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-28169" }, { "cve": "CVE-2021-28861", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-28861" }, { "cve": "CVE-2021-29425", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-29425" }, { "cve": "CVE-2021-30560", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-30560" }, { "cve": "CVE-2021-3114", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3114" }, { "cve": "CVE-2021-33036", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33036" }, { "cve": "CVE-2021-33194", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33194" }, { "cve": "CVE-2021-33195", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33195" }, { "cve": "CVE-2021-33196", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33196" }, { "cve": "CVE-2021-33197", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33197" }, { "cve": "CVE-2021-33503", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33503" }, { "cve": "CVE-2021-33655", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33655" }, { "cve": "CVE-2021-33656", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-33656" }, { "cve": "CVE-2021-3424", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3424" }, { "cve": "CVE-2021-34428", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-34428" }, { "cve": "CVE-2021-3449", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3449" }, { "cve": "CVE-2021-3450", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3450" }, { "cve": "CVE-2021-3530", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3530" }, { "cve": "CVE-2021-36221", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-36221" }, { "cve": "CVE-2021-36373", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-36373" }, { "cve": "CVE-2021-36374", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-36374" }, { "cve": "CVE-2021-3648", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3648" }, { "cve": "CVE-2021-36690", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-36690" }, { "cve": "CVE-2021-3711", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3711" }, { "cve": "CVE-2021-3712", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3712" }, { "cve": "CVE-2021-37136", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-37136" }, { "cve": "CVE-2021-37137", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-37137" }, { "cve": "CVE-2021-37404", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-37404" }, { "cve": "CVE-2021-37533", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-37533" }, { "cve": "CVE-2021-3754", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3754" }, { "cve": "CVE-2021-3778", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3778" }, { "cve": "CVE-2021-3796", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3796" }, { "cve": "CVE-2021-3826", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3826" }, { "cve": "CVE-2021-3827", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3827" }, { "cve": "CVE-2021-38297", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-38297" }, { "cve": "CVE-2021-3872", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3872" }, { "cve": "CVE-2021-3875", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3875" }, { "cve": "CVE-2021-3903", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3903" }, { "cve": "CVE-2021-3923", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3923" }, { "cve": "CVE-2021-3927", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3927" }, { "cve": "CVE-2021-3928", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3928" }, { "cve": "CVE-2021-3968", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3968" }, { "cve": "CVE-2021-3973", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3973" }, { "cve": "CVE-2021-3974", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3974" }, { "cve": "CVE-2021-3984", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-3984" }, { "cve": "CVE-2021-4019", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4019" }, { "cve": "CVE-2021-4037", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4037" }, { "cve": "CVE-2021-4069", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4069" }, { "cve": "CVE-2021-4104", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4104" }, { "cve": "CVE-2021-4136", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4136" }, { "cve": "CVE-2021-4157", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4157" }, { "cve": "CVE-2021-4166", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4166" }, { "cve": "CVE-2021-41771", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-41771" }, { "cve": "CVE-2021-4192", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4192" }, { "cve": "CVE-2021-4193", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4193" }, { "cve": "CVE-2021-4203", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-4203" }, { "cve": "CVE-2021-42567", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-42567" }, { "cve": "CVE-2021-43797", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-43797" }, { "cve": "CVE-2021-44531", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-44531" }, { "cve": "CVE-2021-44532", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-44532" }, { "cve": "CVE-2021-44533", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-44533" }, { "cve": "CVE-2021-44716", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-44716" }, { "cve": "CVE-2021-44878", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-44878" }, { "cve": "CVE-2021-45078", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-45078" }, { "cve": "CVE-2021-46195", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-46195" }, { "cve": "CVE-2021-46828", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-46828" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2021-46848" }, { "cve": "CVE-2022-0128", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0128" }, { "cve": "CVE-2022-0213", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0213" }, { "cve": "CVE-2022-0225", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0225" }, { "cve": "CVE-2022-0261", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0261" }, { "cve": "CVE-2022-0318", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0318" }, { "cve": "CVE-2022-0319", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0319" }, { "cve": "CVE-2022-0351", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0351" }, { "cve": "CVE-2022-0359", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0359" }, { "cve": "CVE-2022-0361", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0361" }, { "cve": "CVE-2022-0392", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0392" }, { "cve": "CVE-2022-0407", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0407" }, { "cve": "CVE-2022-0413", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0413" }, { "cve": "CVE-2022-0561", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0561" }, { "cve": "CVE-2022-0696", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0696" }, { "cve": "CVE-2022-0778", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-0778" }, { "cve": "CVE-2022-1184", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1184" }, { "cve": "CVE-2022-1245", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1245" }, { "cve": "CVE-2022-1271", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1271" }, { "cve": "CVE-2022-1292", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1292" }, { "cve": "CVE-2022-1381", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1381" }, { "cve": "CVE-2022-1420", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1420" }, { "cve": "CVE-2022-1462", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1462" }, { "cve": "CVE-2022-1466", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1466" }, { "cve": "CVE-2022-1471", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1471" }, { "cve": "CVE-2022-1586", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1586" }, { "cve": "CVE-2022-1587", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1587" }, { "cve": "CVE-2022-1616", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1616" }, { "cve": "CVE-2022-1619", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1619" }, { "cve": "CVE-2022-1620", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1620" }, { "cve": "CVE-2022-1679", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1679" }, { "cve": "CVE-2022-1705", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1705" }, { "cve": "CVE-2022-1720", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1720" }, { "cve": "CVE-2022-1729", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1729" }, { "cve": "CVE-2022-1733", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1733" }, { "cve": "CVE-2022-1735", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1735" }, { "cve": "CVE-2022-1771", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1771" }, { "cve": "CVE-2022-1785", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1785" }, { "cve": "CVE-2022-1796", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1796" }, { "cve": "CVE-2022-1851", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1851" }, { "cve": "CVE-2022-1897", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1897" }, { "cve": "CVE-2022-1898", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1898" }, { "cve": "CVE-2022-1927", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1927" }, { "cve": "CVE-2022-1962", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1962" }, { "cve": "CVE-2022-1968", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1968" }, { "cve": "CVE-2022-1974", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1974" }, { "cve": "CVE-2022-1975", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-1975" }, { "cve": "CVE-2022-20132", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-20132" }, { "cve": "CVE-2022-20141", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-20141" }, { "cve": "CVE-2022-20154", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-20154" }, { "cve": "CVE-2022-20166", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-20166" }, { "cve": "CVE-2022-20368", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-20368" }, { "cve": "CVE-2022-20369", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-20369" }, { "cve": "CVE-2022-2047", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2047" }, { "cve": "CVE-2022-2048", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2048" }, { "cve": "CVE-2022-20567", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-20567" }, { "cve": "CVE-2022-2068", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2068" }, { "cve": "CVE-2022-2097", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2097" }, { "cve": "CVE-2022-21216", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21216" }, { "cve": "CVE-2022-21233", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21233" }, { "cve": "CVE-2022-2124", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2124" }, { "cve": "CVE-2022-2125", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2125" }, { "cve": "CVE-2022-2126", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2126" }, { "cve": "CVE-2022-2129", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2129" }, { "cve": "CVE-2022-21363", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21363" }, { "cve": "CVE-2022-21385", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21385" }, { "cve": "CVE-2022-21499", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21499" }, { "cve": "CVE-2022-2153", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2153" }, { "cve": "CVE-2022-21540", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21540" }, { "cve": "CVE-2022-21541", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21541" }, { "cve": "CVE-2022-21549", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21549" }, { "cve": "CVE-2022-21618", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21618" }, { "cve": "CVE-2022-21619", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21619" }, { "cve": "CVE-2022-21624", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21624" }, { "cve": "CVE-2022-21626", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21626" }, { "cve": "CVE-2022-21628", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21628" }, { "cve": "CVE-2022-21702", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-21702" }, { "cve": "CVE-2022-2175", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2175" }, { "cve": "CVE-2022-2182", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2182" }, { "cve": "CVE-2022-2183", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2183" }, { "cve": "CVE-2022-2206", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2206" }, { "cve": "CVE-2022-2207", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2207" }, { "cve": "CVE-2022-2208", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2208" }, { "cve": "CVE-2022-2210", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2210" }, { "cve": "CVE-2022-2231", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2231" }, { "cve": "CVE-2022-2256", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2256" }, { "cve": "CVE-2022-2257", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2257" }, { "cve": "CVE-2022-2264", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2264" }, { "cve": "CVE-2022-2284", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2284" }, { "cve": "CVE-2022-2285", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2285" }, { "cve": "CVE-2022-2286", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2286" }, { "cve": "CVE-2022-2287", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2287" }, { "cve": "CVE-2022-22976", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-22976" }, { "cve": "CVE-2022-22978", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-22978" }, { "cve": "CVE-2022-2304", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2304" }, { "cve": "CVE-2022-2318", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2318" }, { "cve": "CVE-2022-23302", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-23302" }, { "cve": "CVE-2022-23305", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-23305" }, { "cve": "CVE-2022-23307", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-23307" }, { "cve": "CVE-2022-2343", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2343" }, { "cve": "CVE-2022-2344", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2344" }, { "cve": "CVE-2022-2345", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2345" }, { "cve": "CVE-2022-23471", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-23471" }, { "cve": "CVE-2022-23521", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-23521" }, { "cve": "CVE-2022-23772", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-23772" }, { "cve": "CVE-2022-23773", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-23773" }, { "cve": "CVE-2022-24302", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-24302" }, { "cve": "CVE-2022-24329", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-24329" }, { "cve": "CVE-2022-24823", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-24823" }, { "cve": "CVE-2022-24903", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-24903" }, { "cve": "CVE-2022-2503", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2503" }, { "cve": "CVE-2022-25147", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-25147" }, { "cve": "CVE-2022-25168", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-25168" }, { "cve": "CVE-2022-2519", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2519" }, { "cve": "CVE-2022-2520", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2520" }, { "cve": "CVE-2022-2521", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2521" }, { "cve": "CVE-2022-2522", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2522" }, { "cve": "CVE-2022-25647", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-25647" }, { "cve": "CVE-2022-2571", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2571" }, { "cve": "CVE-2022-2580", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2580" }, { "cve": "CVE-2022-2581", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2581" }, { "cve": "CVE-2022-25857", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-25857" }, { "cve": "CVE-2022-2588", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2588" }, { "cve": "CVE-2022-2598", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2598" }, { "cve": "CVE-2022-26148", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-26148" }, { "cve": "CVE-2022-26365", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-26365" }, { "cve": "CVE-2022-26373", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-26373" }, { "cve": "CVE-2022-2639", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2639" }, { "cve": "CVE-2022-26612", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-26612" }, { "cve": "CVE-2022-2663", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2663" }, { "cve": "CVE-2022-27781", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-27781" }, { "cve": "CVE-2022-27782", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-27782" }, { "cve": "CVE-2022-27943", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-27943" }, { "cve": "CVE-2022-2795", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2795" }, { "cve": "CVE-2022-28131", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-28131" }, { "cve": "CVE-2022-2816", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2816" }, { "cve": "CVE-2022-2817", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2817" }, { "cve": "CVE-2022-2819", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2819" }, { "cve": "CVE-2022-28327", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-28327" }, { "cve": "CVE-2022-2845", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2845" }, { "cve": "CVE-2022-2849", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2849" }, { "cve": "CVE-2022-2862", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2862" }, { "cve": "CVE-2022-2867", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2867" }, { "cve": "CVE-2022-2868", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2868" }, { "cve": "CVE-2022-2869", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2869" }, { "cve": "CVE-2022-28693", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-28693" }, { "cve": "CVE-2022-2874", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2874" }, { "cve": "CVE-2022-28748", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-28748" }, { "cve": "CVE-2022-2880", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2880" }, { "cve": "CVE-2022-2889", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2889" }, { "cve": "CVE-2022-29162", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-29162" }, { "cve": "CVE-2022-29187", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-29187" }, { "cve": "CVE-2022-2923", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2923" }, { "cve": "CVE-2022-2946", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2946" }, { "cve": "CVE-2022-29526", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-29526" }, { "cve": "CVE-2022-29583", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-29583" }, { "cve": "CVE-2022-2964", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2964" }, { "cve": "CVE-2022-2977", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2977" }, { "cve": "CVE-2022-2980", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2980" }, { "cve": "CVE-2022-2982", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2982" }, { "cve": "CVE-2022-29900", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-29900" }, { "cve": "CVE-2022-29901", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-29901" }, { "cve": "CVE-2022-2991", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-2991" }, { "cve": "CVE-2022-3016", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3016" }, { "cve": "CVE-2022-3028", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3028" }, { "cve": "CVE-2022-3037", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3037" }, { "cve": "CVE-2022-30580", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-30580" }, { "cve": "CVE-2022-30630", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-30630" }, { "cve": "CVE-2022-30631", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-30631" }, { "cve": "CVE-2022-30632", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-30632" }, { "cve": "CVE-2022-30633", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-30633" }, { "cve": "CVE-2022-3099", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3099" }, { "cve": "CVE-2022-31030", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-31030" }, { "cve": "CVE-2022-31159", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-31159" }, { "cve": "CVE-2022-3134", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3134" }, { "cve": "CVE-2022-3153", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3153" }, { "cve": "CVE-2022-3169", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3169" }, { "cve": "CVE-2022-31690", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-31690" }, { "cve": "CVE-2022-32148", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-32148" }, { "cve": "CVE-2022-32149", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-32149" }, { "cve": "CVE-2022-32206", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-32206" }, { "cve": "CVE-2022-32208", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-32208" }, { "cve": "CVE-2022-32221", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-32221" }, { "cve": "CVE-2022-3234", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3234" }, { "cve": "CVE-2022-3235", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3235" }, { "cve": "CVE-2022-3239", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3239" }, { "cve": "CVE-2022-3278", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3278" }, { "cve": "CVE-2022-3296", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3296" }, { "cve": "CVE-2022-3297", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3297" }, { "cve": "CVE-2022-33196", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-33196" }, { "cve": "CVE-2022-3324", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3324" }, { "cve": "CVE-2022-3352", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3352" }, { "cve": "CVE-2022-33740", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-33740" }, { "cve": "CVE-2022-33741", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-33741" }, { "cve": "CVE-2022-33742", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-33742" }, { "cve": "CVE-2022-33972", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-33972" }, { "cve": "CVE-2022-33981", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-33981" }, { "cve": "CVE-2022-34169", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-34169" }, { "cve": "CVE-2022-3424", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3424" }, { "cve": "CVE-2022-34266", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-34266" }, { "cve": "CVE-2022-34526", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-34526" }, { "cve": "CVE-2022-34903", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-34903" }, { "cve": "CVE-2022-3491", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3491" }, { "cve": "CVE-2022-3515", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3515" }, { "cve": "CVE-2022-3520", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3520" }, { "cve": "CVE-2022-3521", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3521" }, { "cve": "CVE-2022-3524", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3524" }, { "cve": "CVE-2022-35252", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-35252" }, { "cve": "CVE-2022-3542", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3542" }, { "cve": "CVE-2022-3545", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3545" }, { "cve": "CVE-2022-3564", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3564" }, { "cve": "CVE-2022-3565", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3565" }, { "cve": "CVE-2022-3566", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3566" }, { "cve": "CVE-2022-3567", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3567" }, { "cve": "CVE-2022-35737", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-35737" }, { "cve": "CVE-2022-3586", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3586" }, { "cve": "CVE-2022-3591", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3591" }, { "cve": "CVE-2022-3594", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3594" }, { "cve": "CVE-2022-3597", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3597" }, { "cve": "CVE-2022-3599", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3599" }, { "cve": "CVE-2022-36109", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-36109" }, { "cve": "CVE-2022-3621", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3621" }, { "cve": "CVE-2022-3626", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3626" }, { "cve": "CVE-2022-3627", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3627" }, { "cve": "CVE-2022-3628", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3628" }, { "cve": "CVE-2022-36280", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-36280" }, { "cve": "CVE-2022-3629", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3629" }, { "cve": "CVE-2022-3635", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3635" }, { "cve": "CVE-2022-3643", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3643" }, { "cve": "CVE-2022-36437", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-36437" }, { "cve": "CVE-2022-3646", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3646" }, { "cve": "CVE-2022-3649", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3649" }, { "cve": "CVE-2022-36760", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-36760" }, { "cve": "CVE-2022-36879", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-36879" }, { "cve": "CVE-2022-36946", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-36946" }, { "cve": "CVE-2022-3705", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3705" }, { "cve": "CVE-2022-37434", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-37434" }, { "cve": "CVE-2022-37436", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-37436" }, { "cve": "CVE-2022-37865", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-37865" }, { "cve": "CVE-2022-37866", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-37866" }, { "cve": "CVE-2022-38090", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38090" }, { "cve": "CVE-2022-38096", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38096" }, { "cve": "CVE-2022-38126", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38126" }, { "cve": "CVE-2022-38127", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38127" }, { "cve": "CVE-2022-38177", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38177" }, { "cve": "CVE-2022-38178", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38178" }, { "cve": "CVE-2022-3821", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3821" }, { "cve": "CVE-2022-38533", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38533" }, { "cve": "CVE-2022-38749", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38749" }, { "cve": "CVE-2022-38750", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38750" }, { "cve": "CVE-2022-38751", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38751" }, { "cve": "CVE-2022-38752", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-38752" }, { "cve": "CVE-2022-39028", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-39028" }, { "cve": "CVE-2022-3903", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3903" }, { "cve": "CVE-2022-39188", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-39188" }, { "cve": "CVE-2022-39399", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-39399" }, { "cve": "CVE-2022-3970", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-3970" }, { "cve": "CVE-2022-40149", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40149" }, { "cve": "CVE-2022-40150", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40150" }, { "cve": "CVE-2022-40151", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40151" }, { "cve": "CVE-2022-40152", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40152" }, { "cve": "CVE-2022-40153", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40153" }, { "cve": "CVE-2022-40303", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40303" }, { "cve": "CVE-2022-40304", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40304" }, { "cve": "CVE-2022-40307", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40307" }, { "cve": "CVE-2022-40674", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40674" }, { "cve": "CVE-2022-40768", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40768" }, { "cve": "CVE-2022-40899", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-40899" }, { "cve": "CVE-2022-4095", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4095" }, { "cve": "CVE-2022-41218", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41218" }, { "cve": "CVE-2022-4129", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4129" }, { "cve": "CVE-2022-4141", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4141" }, { "cve": "CVE-2022-41717", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41717" }, { "cve": "CVE-2022-41721", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41721" }, { "cve": "CVE-2022-41848", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41848" }, { "cve": "CVE-2022-41850", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41850" }, { "cve": "CVE-2022-41854", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41854" }, { "cve": "CVE-2022-41858", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41858" }, { "cve": "CVE-2022-41881", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41881" }, { "cve": "CVE-2022-41903", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41903" }, { "cve": "CVE-2022-41915", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41915" }, { "cve": "CVE-2022-41966", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41966" }, { "cve": "CVE-2022-41974", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-41974" }, { "cve": "CVE-2022-42003", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42003" }, { "cve": "CVE-2022-42004", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42004" }, { "cve": "CVE-2022-42010", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42010" }, { "cve": "CVE-2022-42011", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42011" }, { "cve": "CVE-2022-42012", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42012" }, { "cve": "CVE-2022-42328", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42328" }, { "cve": "CVE-2022-42329", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42329" }, { "cve": "CVE-2022-42703", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42703" }, { "cve": "CVE-2022-42889", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42889" }, { "cve": "CVE-2022-42895", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42895" }, { "cve": "CVE-2022-42896", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42896" }, { "cve": "CVE-2022-42898", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42898" }, { "cve": "CVE-2022-4292", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4292" }, { "cve": "CVE-2022-4293", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4293" }, { "cve": "CVE-2022-42969", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-42969" }, { "cve": "CVE-2022-4304", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4304" }, { "cve": "CVE-2022-43552", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-43552" }, { "cve": "CVE-2022-43680", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-43680" }, { "cve": "CVE-2022-43750", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-43750" }, { "cve": "CVE-2022-4378", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4378" }, { "cve": "CVE-2022-43945", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-43945" }, { "cve": "CVE-2022-43995", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-43995" }, { "cve": "CVE-2022-4415", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4415" }, { "cve": "CVE-2022-4450", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4450" }, { "cve": "CVE-2022-44638", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-44638" }, { "cve": "CVE-2022-45061", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45061" }, { "cve": "CVE-2022-45688", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45688" }, { "cve": "CVE-2022-45884", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45884" }, { "cve": "CVE-2022-45885", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45885" }, { "cve": "CVE-2022-45886", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45886" }, { "cve": "CVE-2022-45887", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45887" }, { "cve": "CVE-2022-45919", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45919" }, { "cve": "CVE-2022-45934", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45934" }, { "cve": "CVE-2022-45939", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-45939" }, { "cve": "CVE-2022-4662", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-4662" }, { "cve": "CVE-2022-46751", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-46751" }, { "cve": "CVE-2022-46908", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-46908" }, { "cve": "CVE-2022-47629", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-47629" }, { "cve": "CVE-2022-47929", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-47929" }, { "cve": "CVE-2022-48281", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-48281" }, { "cve": "CVE-2022-48337", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-48337" }, { "cve": "CVE-2022-48339", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2022-48339" }, { "cve": "CVE-2023-0045", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0045" }, { "cve": "CVE-2023-0049", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0049" }, { "cve": "CVE-2023-0051", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0051" }, { "cve": "CVE-2023-0054", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0054" }, { "cve": "CVE-2023-0215", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0215" }, { "cve": "CVE-2023-0286", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0286" }, { "cve": "CVE-2023-0288", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0288" }, { "cve": "CVE-2023-0433", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0433" }, { "cve": "CVE-2023-0464", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0464" }, { "cve": "CVE-2023-0465", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0465" }, { "cve": "CVE-2023-0466", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0466" }, { "cve": "CVE-2023-0512", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0512" }, { "cve": "CVE-2023-0590", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0590" }, { "cve": "CVE-2023-0597", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0597" }, { "cve": "CVE-2023-0833", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-0833" }, { "cve": "CVE-2023-1076", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1076" }, { "cve": "CVE-2023-1095", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1095" }, { "cve": "CVE-2023-1118", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1118" }, { "cve": "CVE-2023-1127", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1127" }, { "cve": "CVE-2023-1170", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1170" }, { "cve": "CVE-2023-1175", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1175" }, { "cve": "CVE-2023-1370", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1370" }, { "cve": "CVE-2023-1380", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1380" }, { "cve": "CVE-2023-1390", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1390" }, { "cve": "CVE-2023-1436", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1436" }, { "cve": "CVE-2023-1513", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1513" }, { "cve": "CVE-2023-1611", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1611" }, { "cve": "CVE-2023-1670", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1670" }, { "cve": "CVE-2023-1855", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1855" }, { "cve": "CVE-2023-1989", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1989" }, { "cve": "CVE-2023-1990", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1990" }, { "cve": "CVE-2023-1998", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-1998" }, { "cve": "CVE-2023-20862", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-20862" }, { "cve": "CVE-2023-2124", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2124" }, { "cve": "CVE-2023-2162", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2162" }, { "cve": "CVE-2023-2176", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2176" }, { "cve": "CVE-2023-21830", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21830" }, { "cve": "CVE-2023-21835", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21835" }, { "cve": "CVE-2023-21843", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21843" }, { "cve": "CVE-2023-21930", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21930" }, { "cve": "CVE-2023-21937", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21937" }, { "cve": "CVE-2023-21938", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21938" }, { "cve": "CVE-2023-21939", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21939" }, { "cve": "CVE-2023-2194", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2194" }, { "cve": "CVE-2023-21954", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21954" }, { "cve": "CVE-2023-21967", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21967" }, { "cve": "CVE-2023-21968", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-21968" }, { "cve": "CVE-2023-22490", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-22490" }, { "cve": "CVE-2023-2253", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2253" }, { "cve": "CVE-2023-22809", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-22809" }, { "cve": "CVE-2023-23454", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-23454" }, { "cve": "CVE-2023-23455", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-23455" }, { "cve": "CVE-2023-23559", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-23559" }, { "cve": "CVE-2023-23916", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-23916" }, { "cve": "CVE-2023-23946", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-23946" }, { "cve": "CVE-2023-24329", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-24329" }, { "cve": "CVE-2023-24532", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-24532" }, { "cve": "CVE-2023-24534", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-24534" }, { "cve": "CVE-2023-2483", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2483" }, { "cve": "CVE-2023-24998", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-24998" }, { "cve": "CVE-2023-2513", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2513" }, { "cve": "CVE-2023-25193", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-25193" }, { "cve": "CVE-2023-25652", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-25652" }, { "cve": "CVE-2023-25690", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-25690" }, { "cve": "CVE-2023-25809", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-25809" }, { "cve": "CVE-2023-25815", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-25815" }, { "cve": "CVE-2023-26048", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-26048" }, { "cve": "CVE-2023-26049", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-26049" }, { "cve": "CVE-2023-2650", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2650" }, { "cve": "CVE-2023-26545", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-26545" }, { "cve": "CVE-2023-26604", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-26604" }, { "cve": "CVE-2023-27533", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-27533" }, { "cve": "CVE-2023-27534", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-27534" }, { "cve": "CVE-2023-27535", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-27535" }, { "cve": "CVE-2023-27536", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-27536" }, { "cve": "CVE-2023-27538", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-27538" }, { "cve": "CVE-2023-27561", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-27561" }, { "cve": "CVE-2023-2828", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2828" }, { "cve": "CVE-2023-28320", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28320" }, { "cve": "CVE-2023-28321", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28321" }, { "cve": "CVE-2023-28322", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28322" }, { "cve": "CVE-2023-28328", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28328" }, { "cve": "CVE-2023-28464", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28464" }, { "cve": "CVE-2023-28486", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28486" }, { "cve": "CVE-2023-28487", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28487" }, { "cve": "CVE-2023-28642", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28642" }, { "cve": "CVE-2023-28772", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28772" }, { "cve": "CVE-2023-28840", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28840" }, { "cve": "CVE-2023-28841", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28841" }, { "cve": "CVE-2023-28842", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-28842" }, { "cve": "CVE-2023-29007", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-29007" }, { "cve": "CVE-2023-29383", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-29383" }, { "cve": "CVE-2023-29402", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-29402" }, { "cve": "CVE-2023-29406", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-29406" }, { "cve": "CVE-2023-29409", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-29409" }, { "cve": "CVE-2023-2976", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-2976" }, { "cve": "CVE-2023-30630", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-30630" }, { "cve": "CVE-2023-30772", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-30772" }, { "cve": "CVE-2023-31084", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-31084" }, { "cve": "CVE-2023-3138", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-3138" }, { "cve": "CVE-2023-31436", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-31436" }, { "cve": "CVE-2023-31484", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-31484" }, { "cve": "CVE-2023-32269", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-32269" }, { "cve": "CVE-2023-32697", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-32697" }, { "cve": "CVE-2023-33264", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-33264" }, { "cve": "CVE-2023-34034", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-34034" }, { "cve": "CVE-2023-34035", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-34035" }, { "cve": "CVE-2023-34453", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-34453" }, { "cve": "CVE-2023-34454", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-34454" }, { "cve": "CVE-2023-34455", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-34455" }, { "cve": "CVE-2023-34462", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-34462" }, { "cve": "CVE-2023-35116", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-35116" }, { "cve": "CVE-2023-3635", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-3635" }, { "cve": "CVE-2023-36479", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-36479" }, { "cve": "CVE-2023-39533", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-39533" }, { "cve": "CVE-2023-40167", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-40167" }, { "cve": "CVE-2023-40217", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-40217" }, { "cve": "CVE-2023-41105", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-41105" }, { "cve": "CVE-2023-41900", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-41900" }, { "cve": "CVE-2023-43642", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-43642" }, { "cve": "CVE-2023-43804", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-43804" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-45803", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2023-45803" }, { "cve": "CVE-2024-21626", "notes": [ { "category": "description", "text": "In Dell ECS existieren mehrere Schwachstellen. Diese bestehen in diversen Komponenten von Drittanbietern. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "release_date": "2024-04-04T22:00:00Z", "title": "CVE-2024-21626" } ] }
wid-sec-w-2022-0099
Vulnerability from csaf_certbund
Published
2022-01-10 23:00
Modified
2024-05-09 22:00
Summary
Node.js: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Dateien zu manipulieren.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Dateien zu manipulieren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0099 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0099.json" }, { "category": "self", "summary": "WID-SEC-2022-0099 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0099" }, { "category": "external", "summary": "NodeJs Security Release vom 2022-01-10", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0113-1 vom 2022-01-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010021.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0114-1 vom 2022-01-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010019.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0112-1 vom 2022-01-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010023.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0101-1 vom 2022-01-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010017.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4914 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4914" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-019 vom 2022-02-03", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-019.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:1717-1 vom 2022-05-17", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-May/011058.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0570-1 vom 2022-02-24", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-February/010306.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5170 vom 2022-06-27", "url": "https://lists.debian.org/debian-security-announce/2022/msg00138.html" }, { "category": "external", "summary": "NetApp Security Advisory NTAP-20220729-0004 vom 2022-08-19", "url": "https://security.netapp.com/advisory/ntap-20220729-0004/" }, { "category": "external", "summary": "Debian Security Advisory DLA-3137 vom 2022-10-05", "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:7044 vom 2022-10-19", "url": "https://access.redhat.com/errata/RHSA-2022:7044" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:7830 vom 2022-11-08", "url": "https://access.redhat.com/errata/RHSA-2022:7830" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-214 vom 2022-12-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-214.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:9073 vom 2022-12-15", "url": "https://access.redhat.com/errata/RHSA-2022:9073" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-9073 vom 2022-12-17", "url": "http://linux.oracle.com/errata/ELSA-2022-9073-1.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1742 vom 2023-04-12", "url": "https://access.redhat.com/errata/RHSA-2023:1742" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202405-29 vom 2024-05-08", "url": "https://security.gentoo.org/glsa/202405-29" } ], "source_lang": "en-US", "title": "Node.js: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-09T22:00:00.000+00:00", "generator": { "date": "2024-05-10T09:04:17.977+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0099", "initial_release_date": "2022-01-10T23:00:00.000+00:00", "revision_history": [ { "date": "2022-01-10T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-01-12T23:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: FEDORA-2022-0EDA327CB4, FEDORA-2022-78090D2099" }, { "date": "2022-01-18T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-02-03T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-02-24T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-05-17T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-06-06T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-06-27T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2022-08-21T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von NetApp aufgenommen" }, { "date": "2022-10-05T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2022-10-19T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-11-08T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-12-11T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-12-15T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-12-18T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-04-12T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-05-09T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Gentoo aufgenommen" } ], "status": "final", "version": "17" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "NetApp ActiveIQ Unified Manager", "product": { "name": "NetApp ActiveIQ Unified Manager", "product_id": "T016960", "product_identification_helper": { "cpe": "cpe:/a:netapp:active_iq_unified_manager:-" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003cv17.3.1", "product": { "name": "Open Source Node.js \u003cv17.3.1", "product_id": "T021503", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:v17.3.1" } } }, { "category": "product_version_range", "name": "\u003cv16.13.2 (LTS)", "product": { "name": "Open Source Node.js \u003cv16.13.2 (LTS)", "product_id": "T021504", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:v" } } }, { "category": "product_version_range", "name": "\u003cv14.18.3 (LTS)", "product": { "name": "Open Source Node.js \u003cv14.18.3 (LTS)", "product_id": "T021505", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:v" } } }, { "category": "product_version_range", "name": "\u003cv12.22.9 (LTS)", "product": { "name": "Open Source Node.js \u003cv12.22.9 (LTS)", "product_id": "T021506", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:v" } } } ], "category": "product_name", "name": "Node.js" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44531", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen. Die Schwachstellen sind auf Fehler im Umgang mit Zertifikaten sowie einen Prototype Pollution-Fehler zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "398363", "T012167", "T004914", "T016960" ] }, "release_date": "2022-01-10T23:00:00Z", "title": "CVE-2021-44531" }, { "cve": "CVE-2021-44532", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen. Die Schwachstellen sind auf Fehler im Umgang mit Zertifikaten sowie einen Prototype Pollution-Fehler zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "398363", "T012167", "T004914", "T016960" ] }, "release_date": "2022-01-10T23:00:00Z", "title": "CVE-2021-44532" }, { "cve": "CVE-2021-44533", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen. Die Schwachstellen sind auf Fehler im Umgang mit Zertifikaten sowie einen Prototype Pollution-Fehler zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "398363", "T012167", "T004914", "T016960" ] }, "release_date": "2022-01-10T23:00:00Z", "title": "CVE-2021-44533" }, { "cve": "CVE-2022-21824", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen. Die Schwachstellen sind auf Fehler im Umgang mit Zertifikaten sowie einen Prototype Pollution-Fehler zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "398363", "T012167", "T004914", "T016960" ] }, "release_date": "2022-01-10T23:00:00Z", "title": "CVE-2022-21824" } ] }
wid-sec-w-2022-0432
Vulnerability from csaf_certbund
Published
2022-06-21 22:00
Modified
2023-04-03 22:00
Summary
Xerox FreeFlow Print Server: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.
Betroffene Betriebssysteme
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0432 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0432.json" }, { "category": "self", "summary": "WID-SEC-2022-0432 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0432" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-005 vom 2023-04-04", "url": "https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf" }, { "category": "external", "summary": "Xerox Mini Bulletin XRX21A vom 2022-06-21", "url": "https://security.business.xerox.com/wp-content/uploads/2022/06/Xerox-Security-Bulletin-XRX22-014-FreeFlow-Print-Server-v9.pdf" } ], "source_lang": "en-US", "title": "Xerox FreeFlow Print Server: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-04-03T22:00:00.000+00:00", "generator": { "date": "2024-02-15T16:49:40.951+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0432", "initial_release_date": "2022-06-21T22:00:00.000+00:00", "revision_history": [ { "date": "2022-06-21T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-04-03T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Xerox FreeFlow Print Server 9", "product": { "name": "Xerox FreeFlow Print Server 9", "product_id": "T002977", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:9" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server v9", "product": { "name": "Xerox FreeFlow Print Server v9", "product_id": "T015632", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v9" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-2124", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2016-2124" }, { "cve": "CVE-2019-14822", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2019-14822" }, { "cve": "CVE-2019-19906", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2019-19906" }, { "cve": "CVE-2020-15250", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-15250" }, { "cve": "CVE-2020-17049", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-17049" }, { "cve": "CVE-2020-25717", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-25717" }, { "cve": "CVE-2020-25718", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-25718" }, { "cve": "CVE-2020-25719", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-25719" }, { "cve": "CVE-2020-25721", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-25721" }, { "cve": "CVE-2020-25722", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-25722" }, { "cve": "CVE-2020-9484", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2020-9484" }, { "cve": "CVE-2021-21707", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-21707" }, { "cve": "CVE-2021-22926", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-22926" }, { "cve": "CVE-2021-23192", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-23192" }, { "cve": "CVE-2021-27815", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-27815" }, { "cve": "CVE-2021-30846", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-30846" }, { "cve": "CVE-2021-30848", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-30848" }, { "cve": "CVE-2021-30849", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-30849" }, { "cve": "CVE-2021-30851", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-30851" }, { "cve": "CVE-2021-30858", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-30858" }, { "cve": "CVE-2021-33430", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-33430" }, { "cve": "CVE-2021-34141", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-34141" }, { "cve": "CVE-2021-35604", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-35604" }, { "cve": "CVE-2021-35624", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-35624" }, { "cve": "CVE-2021-3572", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3572" }, { "cve": "CVE-2021-3711", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3711" }, { "cve": "CVE-2021-3733", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3733" }, { "cve": "CVE-2021-3737", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3737" }, { "cve": "CVE-2021-3738", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3738" }, { "cve": "CVE-2021-3770", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3770" }, { "cve": "CVE-2021-3778", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3778" }, { "cve": "CVE-2021-3796", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3796" }, { "cve": "CVE-2021-38115", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-38115" }, { "cve": "CVE-2021-3872", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3872" }, { "cve": "CVE-2021-3875", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3875" }, { "cve": "CVE-2021-3903", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3903" }, { "cve": "CVE-2021-39212", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39212" }, { "cve": "CVE-2021-39272", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39272" }, { "cve": "CVE-2021-3928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3928" }, { "cve": "CVE-2021-3968", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3968" }, { "cve": "CVE-2021-3973", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3973" }, { "cve": "CVE-2021-3974", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3974" }, { "cve": "CVE-2021-3984", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-3984" }, { "cve": "CVE-2021-39920", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39920" }, { "cve": "CVE-2021-39921", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39921" }, { "cve": "CVE-2021-39922", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39922" }, { "cve": "CVE-2021-39923", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39923" }, { "cve": "CVE-2021-39924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39924" }, { "cve": "CVE-2021-39925", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39925" }, { "cve": "CVE-2021-39926", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39926" }, { "cve": "CVE-2021-39928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39928" }, { "cve": "CVE-2021-39929", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-39929" }, { "cve": "CVE-2021-4008", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4008" }, { "cve": "CVE-2021-4009", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4009" }, { "cve": "CVE-2021-4010", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4010" }, { "cve": "CVE-2021-4011", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4011" }, { "cve": "CVE-2021-40145", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-40145" }, { "cve": "CVE-2021-4019", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4019" }, { "cve": "CVE-2021-4034", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4034" }, { "cve": "CVE-2021-4069", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4069" }, { "cve": "CVE-2021-40812", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-40812" }, { "cve": "CVE-2021-41133", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-41133" }, { "cve": "CVE-2021-4140", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4140" }, { "cve": "CVE-2021-41495", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-41495" }, { "cve": "CVE-2021-41496", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-41496" }, { "cve": "CVE-2021-4181", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4181" }, { "cve": "CVE-2021-41817", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-41817" }, { "cve": "CVE-2021-41819", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-41819" }, { "cve": "CVE-2021-4182", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4182" }, { "cve": "CVE-2021-4183", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4183" }, { "cve": "CVE-2021-4184", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4184" }, { "cve": "CVE-2021-4185", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-4185" }, { "cve": "CVE-2021-42717", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-42717" }, { "cve": "CVE-2021-42762", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-42762" }, { "cve": "CVE-2021-43331", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43331" }, { "cve": "CVE-2021-43332", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43332" }, { "cve": "CVE-2021-43395", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43395" }, { "cve": "CVE-2021-43527", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43527" }, { "cve": "CVE-2021-43528", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43528" }, { "cve": "CVE-2021-43536", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43536" }, { "cve": "CVE-2021-43537", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43537" }, { "cve": "CVE-2021-43538", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43538" }, { "cve": "CVE-2021-43539", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43539" }, { "cve": "CVE-2021-43541", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43541" }, { "cve": "CVE-2021-43542", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43542" }, { "cve": "CVE-2021-43543", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43543" }, { "cve": "CVE-2021-43545", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43545" }, { "cve": "CVE-2021-43546", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43546" }, { "cve": "CVE-2021-43566", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43566" }, { "cve": "CVE-2021-43818", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-43818" }, { "cve": "CVE-2021-44142", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44142" }, { "cve": "CVE-2021-44224", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44224" }, { "cve": "CVE-2021-44227", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44227" }, { "cve": "CVE-2021-44420", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44420" }, { "cve": "CVE-2021-44531", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44531" }, { "cve": "CVE-2021-44532", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44532" }, { "cve": "CVE-2021-44533", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44533" }, { "cve": "CVE-2021-44540", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44540" }, { "cve": "CVE-2021-44541", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44541" }, { "cve": "CVE-2021-44542", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44542" }, { "cve": "CVE-2021-44543", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44543" }, { "cve": "CVE-2021-44790", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-44790" }, { "cve": "CVE-2021-45078", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-45078" }, { "cve": "CVE-2021-45115", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-45115" }, { "cve": "CVE-2021-45116", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-45116" }, { "cve": "CVE-2021-45452", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-45452" }, { "cve": "CVE-2021-45960", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-45960" }, { "cve": "CVE-2021-46143", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2021-46143" }, { "cve": "CVE-2022-0336", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0336" }, { "cve": "CVE-2022-0391", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0391" }, { "cve": "CVE-2022-0566", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0566" }, { "cve": "CVE-2022-0581", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0581" }, { "cve": "CVE-2022-0582", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0582" }, { "cve": "CVE-2022-0583", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0583" }, { "cve": "CVE-2022-0585", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0585" }, { "cve": "CVE-2022-0586", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0586" }, { "cve": "CVE-2022-0778", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-0778" }, { "cve": "CVE-2022-21248", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21248" }, { "cve": "CVE-2022-21263", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21263" }, { "cve": "CVE-2022-21271", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21271" }, { "cve": "CVE-2022-21282", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21282" }, { "cve": "CVE-2022-21291", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21291" }, { "cve": "CVE-2022-21293", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21293" }, { "cve": "CVE-2022-21294", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21294" }, { "cve": "CVE-2022-21296", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21296" }, { "cve": "CVE-2022-21298", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21298" }, { "cve": "CVE-2022-21299", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21299" }, { "cve": "CVE-2022-21305", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21305" }, { "cve": "CVE-2022-21340", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21340" }, { "cve": "CVE-2022-21341", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21341" }, { "cve": "CVE-2022-21349", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21349" }, { "cve": "CVE-2022-21360", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21360" }, { "cve": "CVE-2022-21365", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21365" }, { "cve": "CVE-2022-21375", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21375" }, { "cve": "CVE-2022-21384", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21384" }, { "cve": "CVE-2022-21416", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21416" }, { "cve": "CVE-2022-21446", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21446" }, { "cve": "CVE-2022-21461", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21461" }, { "cve": "CVE-2022-21463", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21463" }, { "cve": "CVE-2022-21493", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21493" }, { "cve": "CVE-2022-21494", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21494" }, { "cve": "CVE-2022-21712", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21712" }, { "cve": "CVE-2022-21716", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21716" }, { "cve": "CVE-2022-21824", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-21824" }, { "cve": "CVE-2022-22719", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22719" }, { "cve": "CVE-2022-22720", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22720" }, { "cve": "CVE-2022-22721", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22721" }, { "cve": "CVE-2022-22737", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22737" }, { "cve": "CVE-2022-22738", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22738" }, { "cve": "CVE-2022-22739", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22739" }, { "cve": "CVE-2022-22740", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22740" }, { "cve": "CVE-2022-22741", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22741" }, { "cve": "CVE-2022-22742", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22742" }, { "cve": "CVE-2022-22743", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22743" }, { "cve": "CVE-2022-22744", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22744" }, { "cve": "CVE-2022-22745", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22745" }, { "cve": "CVE-2022-22746", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22746" }, { "cve": "CVE-2022-22747", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22747" }, { "cve": "CVE-2022-22748", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22748" }, { "cve": "CVE-2022-22751", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22751" }, { "cve": "CVE-2022-22753", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22753" }, { "cve": "CVE-2022-22754", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22754" }, { "cve": "CVE-2022-22756", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22756" }, { "cve": "CVE-2022-22759", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22759" }, { "cve": "CVE-2022-22760", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22760" }, { "cve": "CVE-2022-22761", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22761" }, { "cve": "CVE-2022-22763", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22763" }, { "cve": "CVE-2022-22764", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22764" }, { "cve": "CVE-2022-22815", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22815" }, { "cve": "CVE-2022-22816", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22816" }, { "cve": "CVE-2022-22817", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22817" }, { "cve": "CVE-2022-22818", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22818" }, { "cve": "CVE-2022-22822", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22822" }, { "cve": "CVE-2022-22823", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22823" }, { "cve": "CVE-2022-22824", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22824" }, { "cve": "CVE-2022-22825", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22825" }, { "cve": "CVE-2022-22826", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22826" }, { "cve": "CVE-2022-22827", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-22827" }, { "cve": "CVE-2022-23181", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-23181" }, { "cve": "CVE-2022-23833", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-23833" }, { "cve": "CVE-2022-23852", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-23852" }, { "cve": "CVE-2022-23943", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-23943" }, { "cve": "CVE-2022-23990", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-23990" }, { "cve": "CVE-2022-24407", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-24407" }, { "cve": "CVE-2022-25235", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-25235" }, { "cve": "CVE-2022-25236", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-25236" }, { "cve": "CVE-2022-25313", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-25313" }, { "cve": "CVE-2022-25314", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-25314" }, { "cve": "CVE-2022-25315", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-25315" }, { "cve": "CVE-2022-26381", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-26381" }, { "cve": "CVE-2022-26383", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-26383" }, { "cve": "CVE-2022-26384", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-26384" }, { "cve": "CVE-2022-26386", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-26386" }, { "cve": "CVE-2022-26387", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-26387" }, { "cve": "CVE-2022-26485", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-26485" }, { "cve": "CVE-2022-26486", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen, die im Zusammenhang mit der Solaris Betriebssystem Plattform stehen. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Verf\u00fcgbarkeit und Integrit\u00e4t zu gef\u00e4hrden." } ], "product_status": { "known_affected": [ "T015632", "T002977" ] }, "release_date": "2022-06-21T22:00:00Z", "title": "CVE-2022-26486" } ] }
wid-sec-w-2023-1542
Vulnerability from csaf_certbund
Published
2023-06-22 22:00
Modified
2024-05-21 22:00
Summary
Red Hat OpenShift: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1542 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1542.json" }, { "category": "self", "summary": "WID-SEC-2023-1542 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1542" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0139 vom 2024-01-10", "url": "https://access.redhat.com/errata/RHSA-2024:0139" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0143 vom 2024-01-10", "url": "https://access.redhat.com/errata/RHSA-2024:0143" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0137 vom 2024-01-10", "url": "https://access.redhat.com/errata/RHSA-2024:0137" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0121 vom 2024-01-10", "url": "https://access.redhat.com/errata/RHSA-2024:0121" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7820 vom 2023-12-14", "url": "https://access.redhat.com/errata/RHSA-2023:7820" }, { "category": "external", "summary": "Meinberg Security Advisory", "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2024-01-lantime-firmware-v7-08-007.htm" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3742 vom 2023-06-22", "url": "https://access.redhat.com/errata/RHSA-2023:3742" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3612 vom 2023-06-23", "url": "https://access.redhat.com/errata/RHSA-2023:3614" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3615 vom 2023-06-22", "url": "https://access.redhat.com/errata/RHSA-2023:3615" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3613 vom 2023-06-27", "url": "https://access.redhat.com/errata/RHSA-2023:3613" }, { "category": "external", "summary": "Red Hat Security Advisory vom 2023-06-29", "url": "https://access.redhat.com/errata/RHSA-2023:3918" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3943 vom 2023-06-29", "url": "https://access.redhat.com/errata/RHSA-2023:3943" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3910 vom 2023-07-06", "url": "https://access.redhat.com/errata/RHSA-2023:3910" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3915 vom 2023-07-06", "url": "https://access.redhat.com/errata/RHSA-2023:3915" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3925 vom 2023-07-06", "url": "https://access.redhat.com/errata/RHSA-2023:3925" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4003 vom 2023-07-10", "url": "https://access.redhat.com/errata/RHSA-2023:4003" }, { "category": "external", "summary": "Fedora Security Advisory FEDORA-2023-6CFE7492C1 vom 2023-07-16", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2023-6cfe7492c1" }, { "category": "external", "summary": "Fedora Security Advisory FEDORA-2023-AA7C75ED4A vom 2023-07-16", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2023-aa7c75ed4a" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4025 vom 2023-07-18", "url": "https://access.redhat.com/errata/RHSA-2023:4025" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4112 vom 2023-07-18", "url": "https://access.redhat.com/errata/RHSA-2023:4112" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4113 vom 2023-07-18", "url": "https://access.redhat.com/errata/RHSA-2023:4113" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4114 vom 2023-07-18", "url": "https://access.redhat.com/errata/RHSA-2023:4114" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4053 vom 2023-07-19", "url": "https://access.redhat.com/errata/RHSA-2023:4053" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4204 vom 2023-07-19", "url": "https://access.redhat.com/errata/RHSA-2023:4204" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4090 vom 2023-07-21", "url": "https://access.redhat.com/errata/RHSA-2023:4090" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4241 vom 2023-07-21", "url": "https://access.redhat.com/errata/RHSA-2023:4241" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4238 vom 2023-07-20", "url": "https://access.redhat.com/errata/RHSA-2023:4238" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4093 vom 2023-07-20", "url": "https://access.redhat.com/errata/RHSA-2023:4093" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4091 vom 2023-07-20", "url": "https://access.redhat.com/errata/RHSA-2023:4091" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4225 vom 2023-07-27", "url": "https://access.redhat.com/errata/RHSA-2023:4225" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4226 vom 2023-07-27", "url": "https://access.redhat.com/errata/RHSA-2023:4226" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4470 vom 2023-08-03", "url": "https://access.redhat.com/errata/RHSA-2023:4470" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4335 vom 2023-08-08", "url": "https://access.redhat.com/errata/RHSA-2023:4335" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4674 vom 2023-08-23", "url": "https://access.redhat.com/errata/RHSA-2023:4674" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4983 vom 2023-09-05", "url": "https://access.redhat.com/errata/RHSA-2023:4983" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5103 vom 2023-09-12", "url": "https://access.redhat.com/errata/RHSA-2023:5103" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5233 vom 2023-09-19", "url": "https://access.redhat.com/errata/RHSA-2023:5233" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5314 vom 2023-09-20", "url": "https://access.redhat.com/errata/RHSA-2023:5314" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5006 vom 2023-12-30", "url": "https://access.redhat.com/errata/RHSA-2023:5006" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:6316 vom 2023-11-07", "url": "https://access.redhat.com/errata/RHSA-2023:6316" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7058 vom 2023-11-15", "url": "https://access.redhat.com/errata/RHSA-2023:7058" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7823 vom 2024-01-05", "url": "https://access.redhat.com/errata/RHSA-2023:7823" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-6939 vom 2023-11-21", "url": "https://linux.oracle.com/errata/ELSA-2023-6939.html" }, { "category": "external", "summary": "Fedora Security Advisory FEDORA-2023-14A33318B8 vom 2023-12-03", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2023-14a33318b8" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7672 vom 2023-12-06", "url": "https://access.redhat.com/errata/RHSA-2023:7672" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202405-04 vom 2024-05-04", "url": "https://security.gentoo.org/glsa/202405-04" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:2987 vom 2024-05-22", "url": "https://access.redhat.com/errata/RHSA-2024:2987" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:3254 vom 2024-05-22", "url": "https://access.redhat.com/errata/RHSA-2024:3254" } ], "source_lang": "en-US", "title": "Red Hat OpenShift: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-21T22:00:00.000+00:00", "generator": { "date": "2024-05-22T12:11:49.378+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-1542", "initial_release_date": "2023-06-22T22:00:00.000+00:00", "revision_history": [ { "date": "2023-06-22T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-06-25T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-06-26T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-06-28T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-06-29T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-05T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-06T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-10T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-16T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Fedora aufgenommen" }, { "date": "2023-07-17T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-18T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-20T22:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-07-26T22:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-08-03T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-08-07T22:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-08-23T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-09-05T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-09-12T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-09-19T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-09-20T22:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-11-07T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-11-14T23:00:00.000+00:00", "number": "22", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-11-21T23:00:00.000+00:00", "number": "23", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-12-03T23:00:00.000+00:00", "number": "24", "summary": "Neue Updates von Fedora aufgenommen" }, { "date": "2023-12-06T23:00:00.000+00:00", "number": "25", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-12-13T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-01-01T23:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-01-04T23:00:00.000+00:00", "number": "28", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-01-10T23:00:00.000+00:00", "number": "29", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-01-30T23:00:00.000+00:00", "number": "30", "summary": "Neue Updates von Meinberg aufgenommen" }, { "date": "2024-05-05T22:00:00.000+00:00", "number": "31", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2024-05-21T22:00:00.000+00:00", "number": "32", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "32" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Fedora Linux", "product": { "name": "Fedora Linux", "product_id": "74185", "product_identification_helper": { "cpe": "cpe:/o:fedoraproject:fedora:-" } } } ], "category": "vendor", "name": "Fedora" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c7.08.007", "product": { "name": "Meinberg LANTIME \u003c7.08.007", "product_id": "T032435", "product_identification_helper": { "cpe": "cpe:/h:meinberg:lantime:7.08.007" } } } ], "category": "product_name", "name": "LANTIME" } ], "category": "vendor", "name": "Meinberg" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "category": "product_version", "name": "Advanced Cluster Security for Kubernetes 4", "product": { "name": "Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4", "product_id": "T027916", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4" } } }, { "category": "product_version", "name": "Service Interconnect 1", "product": { "name": "Red Hat Enterprise Linux Service Interconnect 1", "product_id": "T028472", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:service_interconnect_1" } } } ], "category": "product_name", "name": "Enterprise Linux" }, { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift", "product": { "name": "Red Hat OpenShift", "product_id": "T008027", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:-" } } }, { "category": "product_version", "name": "Container Platform 4.12", "product": { "name": "Red Hat OpenShift Container Platform 4.12", "product_id": "T026435", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.12" } } }, { "category": "product_version_range", "name": "Container Platform \u003c4.13.4", "product": { "name": "Red Hat OpenShift Container Platform \u003c4.13.4", "product_id": "T028225", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform__4.13.4" } } }, { "category": "product_version_range", "name": "Data Foundation \u003c4.13.0", "product": { "name": "Red Hat OpenShift Data Foundation \u003c4.13.0", "product_id": "T028289", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:data_foundation_4.13.0" } } }, { "category": "product_version_range", "name": "Container Platform \u003c4.12.22", "product": { "name": "Red Hat OpenShift Container Platform \u003c4.12.22", "product_id": "T028307", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform__4.12.22" } } }, { "category": "product_version_range", "name": "Container Platform \u003c4.11.44", "product": { "name": "Red Hat OpenShift Container Platform \u003c4.11.44", "product_id": "T028416", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform__4.11.44" } } }, { "category": "product_version_range", "name": "Data Foundation \u003c4.12.10", "product": { "name": "Red Hat OpenShift Data Foundation \u003c4.12.10", "product_id": "T031698", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:data_foundation__4.12.10" } } }, { "category": "product_version_range", "name": "Container Platform \u003c4.14.0", "product": { "name": "Red Hat OpenShift Container Platform \u003c4.14.0", "product_id": "T031839", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform__4.14.0" } } }, { "category": "product_version_range", "name": "Container Platform \u003c4.12.46", "product": { "name": "Red Hat OpenShift Container Platform \u003c4.12.46", "product_id": "T031870", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform__4.12.46" } } } ], "category": "product_name", "name": "OpenShift" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-20107", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2015-20107" }, { "cve": "CVE-2018-25032", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2018-25032" }, { "cve": "CVE-2020-10735", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2020-10735" }, { "cve": "CVE-2020-16250", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2020-16250" }, { "cve": "CVE-2020-16251", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2020-16251" }, { "cve": "CVE-2020-17049", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2020-17049" }, { "cve": "CVE-2021-28861", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-28861" }, { "cve": "CVE-2021-3765", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-3765" }, { "cve": "CVE-2021-3807", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-3807" }, { "cve": "CVE-2021-4231", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-4231" }, { "cve": "CVE-2021-4235", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-4235" }, { "cve": "CVE-2021-4238", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-4238" }, { "cve": "CVE-2021-43519", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-43519" }, { "cve": "CVE-2021-43998", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-43998" }, { "cve": "CVE-2021-44531", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-44531" }, { "cve": "CVE-2021-44532", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-44532" }, { "cve": "CVE-2021-44533", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-44533" }, { "cve": "CVE-2021-44964", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-44964" }, { "cve": "CVE-2021-46828", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-46828" }, { "cve": "CVE-2021-46848", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2021-46848" }, { "cve": "CVE-2022-0670", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-0670" }, { "cve": "CVE-2022-1271", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-1271" }, { "cve": "CVE-2022-1304", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-1304" }, { "cve": "CVE-2022-1348", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-1348" }, { "cve": "CVE-2022-1586", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-1586" }, { "cve": "CVE-2022-1587", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-1587" }, { "cve": "CVE-2022-21824", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-21824" }, { "cve": "CVE-2022-2309", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-2309" }, { "cve": "CVE-2022-23540", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-23540" }, { "cve": "CVE-2022-23541", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-23541" }, { "cve": "CVE-2022-24903", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-24903" }, { "cve": "CVE-2022-2509", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-2509" }, { "cve": "CVE-2022-26280", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-26280" }, { "cve": "CVE-2022-27664", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-27664" }, { "cve": "CVE-2022-2795", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-2795" }, { "cve": "CVE-2022-2879", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-2879" }, { "cve": "CVE-2022-2880", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-2880" }, { "cve": "CVE-2022-28805", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-28805" }, { "cve": "CVE-2022-29154", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-29154" }, { "cve": "CVE-2022-30635", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-30635" }, { "cve": "CVE-2022-3094", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3094" }, { "cve": "CVE-2022-31129", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-31129" }, { "cve": "CVE-2022-32189", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-32189" }, { "cve": "CVE-2022-32190", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-32190" }, { "cve": "CVE-2022-33099", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-33099" }, { "cve": "CVE-2022-3358", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3358" }, { "cve": "CVE-2022-34903", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-34903" }, { "cve": "CVE-2022-3515", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3515" }, { "cve": "CVE-2022-3517", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3517" }, { "cve": "CVE-2022-35737", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-35737" }, { "cve": "CVE-2022-36227", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-36227" }, { "cve": "CVE-2022-3715", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3715" }, { "cve": "CVE-2022-3736", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3736" }, { "cve": "CVE-2022-37434", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-37434" }, { "cve": "CVE-2022-38149", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-38149" }, { "cve": "CVE-2022-3821", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3821" }, { "cve": "CVE-2022-38900", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-38900" }, { "cve": "CVE-2022-3924", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-3924" }, { "cve": "CVE-2022-40023", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-40023" }, { "cve": "CVE-2022-40303", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-40303" }, { "cve": "CVE-2022-40304", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-40304" }, { "cve": "CVE-2022-40897", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-40897" }, { "cve": "CVE-2022-41316", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-41316" }, { "cve": "CVE-2022-41715", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-41715" }, { "cve": "CVE-2022-41717", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-41717" }, { "cve": "CVE-2022-41723", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-41723" }, { "cve": "CVE-2022-41724", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-41724" }, { "cve": "CVE-2022-41725", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-41725" }, { "cve": "CVE-2022-42010", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-42010" }, { "cve": "CVE-2022-42011", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-42011" }, { "cve": "CVE-2022-42012", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-42012" }, { "cve": "CVE-2022-42898", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-42898" }, { "cve": "CVE-2022-42919", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-42919" }, { "cve": "CVE-2022-43680", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-43680" }, { "cve": "CVE-2022-4415", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-4415" }, { "cve": "CVE-2022-45061", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-45061" }, { "cve": "CVE-2022-45873", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-45873" }, { "cve": "CVE-2022-46175", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-46175" }, { "cve": "CVE-2022-47024", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-47024" }, { "cve": "CVE-2022-47629", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-47629" }, { "cve": "CVE-2022-48303", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-48303" }, { "cve": "CVE-2022-48337", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-48337" }, { "cve": "CVE-2022-48338", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-48338" }, { "cve": "CVE-2022-48339", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2022-48339" }, { "cve": "CVE-2023-0361", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-0361" }, { "cve": "CVE-2023-0620", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-0620" }, { "cve": "CVE-2023-0665", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-0665" }, { "cve": "CVE-2023-22809", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-22809" }, { "cve": "CVE-2023-24329", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-24329" }, { "cve": "CVE-2023-2491", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-2491" }, { "cve": "CVE-2023-24999", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-24999" }, { "cve": "CVE-2023-25000", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-25000" }, { "cve": "CVE-2023-25136", "notes": [ { "category": "description", "text": "In Red Hat OpenShift existieren mehrere Schwachstellen. Diese sind auf Fehler in verschiedenen Komponenten zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen." } ], "product_status": { "known_affected": [ "T032435", "T031698", "T008027", "T028472", "67646", "T012167", "T004914", "74185", "T031870", "T027916", "T028307", "T028416", "T026435", "T028225", "T031839" ] }, "release_date": "2023-06-22T22:00:00Z", "title": "CVE-2023-25136" } ] }
wid-sec-w-2022-0302
Vulnerability from csaf_certbund
Published
2022-06-14 22:00
Modified
2023-04-03 22:00
Summary
Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.
Betroffene Betriebssysteme
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "FreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.", "title": "Angriff" }, { "category": "general", "text": "- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0302 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0302.json" }, { "category": "self", "summary": "WID-SEC-2022-0302 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0302" }, { "category": "external", "summary": "XEROX Security Advisory XRX23-005 vom 2023-04-04", "url": "https://security.business.xerox.com/wp-content/uploads/2023/04/Xerox-Security-Bulletin-XRX23-005-Xerox%25C2%25AE-FreeFlow%25C2%25AE-Print-Server-v9.pdf" }, { "category": "external", "summary": "Xerox Security Bulletin XRX22-015", "url": "https://security.business.xerox.com/wp-content/uploads/2022/06/Xerox-Security-Bulletin-XRX22-015-FreeFlow-Print-Server-v7.pdf" }, { "category": "external", "summary": "Xerox Security Bulletin XRX22-013 vom 2022-06-14", "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2022/06/Xerox-Security-Bulletin-XRX22-013-FreeFlow-Print-Server-v9.pdf" }, { "category": "external", "summary": "Xerox Security Bulletin XRX22-012 vom 2022-06-14", "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2022/06/Xerox-Security-Bulletin-XRX22-012-FreeFlow-Printer.pdf" } ], "source_lang": "en-US", "title": "Xerox FreeFlow Print Server: Mehrere Schwachstellen erm\u00f6glichen Ausf\u00fchren von beliebigem Programmcode mit Administratorrechten", "tracking": { "current_release_date": "2023-04-03T22:00:00.000+00:00", "generator": { "date": "2024-02-15T16:48:03.842+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0302", "initial_release_date": "2022-06-14T22:00:00.000+00:00", "revision_history": [ { "date": "2022-06-14T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-06-21T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von XEROX aufgenommen" }, { "date": "2023-04-03T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Xerox FreeFlow Print Server 7", "product": { "name": "Xerox FreeFlow Print Server 7", "product_id": "T000872", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:7" } } }, { "category": "product_name", "name": "Xerox FreeFlow Print Server 9", "product": { "name": "Xerox FreeFlow Print Server 9", "product_id": "T002977", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:9" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-2124", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2016-2124" }, { "cve": "CVE-2019-14822", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2019-14822" }, { "cve": "CVE-2019-19906", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2019-19906" }, { "cve": "CVE-2020-15250", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-15250" }, { "cve": "CVE-2020-17049", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-17049" }, { "cve": "CVE-2020-25717", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-25717" }, { "cve": "CVE-2020-25718", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-25718" }, { "cve": "CVE-2020-25719", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-25719" }, { "cve": "CVE-2020-25721", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-25721" }, { "cve": "CVE-2020-25722", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-25722" }, { "cve": "CVE-2020-9484", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2020-9484" }, { "cve": "CVE-2021-21707", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-21707" }, { "cve": "CVE-2021-22926", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-22926" }, { "cve": "CVE-2021-23192", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-23192" }, { "cve": "CVE-2021-27815", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-27815" }, { "cve": "CVE-2021-30846", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-30846" }, { "cve": "CVE-2021-30848", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-30848" }, { "cve": "CVE-2021-30849", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-30849" }, { "cve": "CVE-2021-30851", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-30851" }, { "cve": "CVE-2021-30858", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-30858" }, { "cve": "CVE-2021-33430", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-33430" }, { "cve": "CVE-2021-34141", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-34141" }, { "cve": "CVE-2021-35604", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-35604" }, { "cve": "CVE-2021-35624", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-35624" }, { "cve": "CVE-2021-3572", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3572" }, { "cve": "CVE-2021-3711", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3711" }, { "cve": "CVE-2021-3733", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3733" }, { "cve": "CVE-2021-3737", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3737" }, { "cve": "CVE-2021-3738", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3738" }, { "cve": "CVE-2021-3770", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3770" }, { "cve": "CVE-2021-3778", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3778" }, { "cve": "CVE-2021-3796", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3796" }, { "cve": "CVE-2021-38115", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-38115" }, { "cve": "CVE-2021-3872", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3872" }, { "cve": "CVE-2021-3875", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3875" }, { "cve": "CVE-2021-3903", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3903" }, { "cve": "CVE-2021-39212", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39212" }, { "cve": "CVE-2021-39272", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39272" }, { "cve": "CVE-2021-3928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3928" }, { "cve": "CVE-2021-3968", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3968" }, { "cve": "CVE-2021-3973", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3973" }, { "cve": "CVE-2021-3974", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3974" }, { "cve": "CVE-2021-3984", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-3984" }, { "cve": "CVE-2021-39920", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39920" }, { "cve": "CVE-2021-39921", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39921" }, { "cve": "CVE-2021-39922", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39922" }, { "cve": "CVE-2021-39923", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39923" }, { "cve": "CVE-2021-39924", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39924" }, { "cve": "CVE-2021-39925", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39925" }, { "cve": "CVE-2021-39926", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39926" }, { "cve": "CVE-2021-39928", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39928" }, { "cve": "CVE-2021-39929", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-39929" }, { "cve": "CVE-2021-4008", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4008" }, { "cve": "CVE-2021-4009", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4009" }, { "cve": "CVE-2021-4010", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4010" }, { "cve": "CVE-2021-4011", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4011" }, { "cve": "CVE-2021-40145", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-40145" }, { "cve": "CVE-2021-4019", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4019" }, { "cve": "CVE-2021-4034", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4034" }, { "cve": "CVE-2021-4069", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4069" }, { "cve": "CVE-2021-40812", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-40812" }, { "cve": "CVE-2021-41133", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-41133" }, { "cve": "CVE-2021-4140", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4140" }, { "cve": "CVE-2021-41495", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-41495" }, { "cve": "CVE-2021-41496", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-41496" }, { "cve": "CVE-2021-4160", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4160" }, { "cve": "CVE-2021-4181", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4181" }, { "cve": "CVE-2021-41817", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-41817" }, { "cve": "CVE-2021-41819", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-41819" }, { "cve": "CVE-2021-4182", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4182" }, { "cve": "CVE-2021-4183", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4183" }, { "cve": "CVE-2021-4184", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4184" }, { "cve": "CVE-2021-4185", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-4185" }, { "cve": "CVE-2021-42717", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-42717" }, { "cve": "CVE-2021-42762", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-42762" }, { "cve": "CVE-2021-43331", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43331" }, { "cve": "CVE-2021-43332", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43332" }, { "cve": "CVE-2021-43395", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43395" }, { "cve": "CVE-2021-43527", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43527" }, { "cve": "CVE-2021-43528", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43528" }, { "cve": "CVE-2021-43536", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43536" }, { "cve": "CVE-2021-43537", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43537" }, { "cve": "CVE-2021-43538", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43538" }, { "cve": "CVE-2021-43539", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43539" }, { "cve": "CVE-2021-43541", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43541" }, { "cve": "CVE-2021-43542", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43542" }, { "cve": "CVE-2021-43543", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43543" }, { "cve": "CVE-2021-43545", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43545" }, { "cve": "CVE-2021-43546", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43546" }, { "cve": "CVE-2021-43566", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43566" }, { "cve": "CVE-2021-43818", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-43818" }, { "cve": "CVE-2021-44142", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44142" }, { "cve": "CVE-2021-44224", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44224" }, { "cve": "CVE-2021-44227", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44227" }, { "cve": "CVE-2021-44420", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44420" }, { "cve": "CVE-2021-44531", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44531" }, { "cve": "CVE-2021-44532", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44532" }, { "cve": "CVE-2021-44533", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44533" }, { "cve": "CVE-2021-44540", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44540" }, { "cve": "CVE-2021-44541", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44541" }, { "cve": "CVE-2021-44542", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44542" }, { "cve": "CVE-2021-44543", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44543" }, { "cve": "CVE-2021-44790", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-44790" }, { "cve": "CVE-2021-45078", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-45078" }, { "cve": "CVE-2021-45115", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-45115" }, { "cve": "CVE-2021-45116", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-45116" }, { "cve": "CVE-2021-45452", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-45452" }, { "cve": "CVE-2021-45960", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-45960" }, { "cve": "CVE-2021-46143", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2021-46143" }, { "cve": "CVE-2022-0336", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0336" }, { "cve": "CVE-2022-0391", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0391" }, { "cve": "CVE-2022-0566", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0566" }, { "cve": "CVE-2022-0581", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0581" }, { "cve": "CVE-2022-0582", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0582" }, { "cve": "CVE-2022-0583", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0583" }, { "cve": "CVE-2022-0585", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0585" }, { "cve": "CVE-2022-0586", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0586" }, { "cve": "CVE-2022-0778", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-0778" }, { "cve": "CVE-2022-21248", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21248" }, { "cve": "CVE-2022-21263", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21263" }, { "cve": "CVE-2022-21271", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21271" }, { "cve": "CVE-2022-21282", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21282" }, { "cve": "CVE-2022-21291", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21291" }, { "cve": "CVE-2022-21293", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21293" }, { "cve": "CVE-2022-21294", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21294" }, { "cve": "CVE-2022-21296", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21296" }, { "cve": "CVE-2022-21298", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21298" }, { "cve": "CVE-2022-21299", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21299" }, { "cve": "CVE-2022-21305", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21305" }, { "cve": "CVE-2022-21340", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21340" }, { "cve": "CVE-2022-21341", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21341" }, { "cve": "CVE-2022-21349", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21349" }, { "cve": "CVE-2022-21360", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21360" }, { "cve": "CVE-2022-21365", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21365" }, { "cve": "CVE-2022-21375", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21375" }, { "cve": "CVE-2022-21384", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21384" }, { "cve": "CVE-2022-21416", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21416" }, { "cve": "CVE-2022-21446", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21446" }, { "cve": "CVE-2022-21461", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21461" }, { "cve": "CVE-2022-21463", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21463" }, { "cve": "CVE-2022-21493", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21493" }, { "cve": "CVE-2022-21494", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21494" }, { "cve": "CVE-2022-21712", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21712" }, { "cve": "CVE-2022-21716", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21716" }, { "cve": "CVE-2022-21824", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-21824" }, { "cve": "CVE-2022-22719", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22719" }, { "cve": "CVE-2022-22720", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22720" }, { "cve": "CVE-2022-22721", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22721" }, { "cve": "CVE-2022-22737", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22737" }, { "cve": "CVE-2022-22738", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22738" }, { "cve": "CVE-2022-22739", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22739" }, { "cve": "CVE-2022-22740", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22740" }, { "cve": "CVE-2022-22741", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22741" }, { "cve": "CVE-2022-22742", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22742" }, { "cve": "CVE-2022-22743", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22743" }, { "cve": "CVE-2022-22744", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22744" }, { "cve": "CVE-2022-22745", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22745" }, { "cve": "CVE-2022-22746", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22746" }, { "cve": "CVE-2022-22747", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22747" }, { "cve": "CVE-2022-22748", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22748" }, { "cve": "CVE-2022-22751", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22751" }, { "cve": "CVE-2022-22753", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22753" }, { "cve": "CVE-2022-22754", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22754" }, { "cve": "CVE-2022-22756", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22756" }, { "cve": "CVE-2022-22759", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22759" }, { "cve": "CVE-2022-22760", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22760" }, { "cve": "CVE-2022-22761", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22761" }, { "cve": "CVE-2022-22763", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22763" }, { "cve": "CVE-2022-22764", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22764" }, { "cve": "CVE-2022-22815", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22815" }, { "cve": "CVE-2022-22816", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22816" }, { "cve": "CVE-2022-22817", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22817" }, { "cve": "CVE-2022-22818", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22818" }, { "cve": "CVE-2022-22822", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22822" }, { "cve": "CVE-2022-22823", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22823" }, { "cve": "CVE-2022-22824", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22824" }, { "cve": "CVE-2022-22825", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22825" }, { "cve": "CVE-2022-22826", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22826" }, { "cve": "CVE-2022-22827", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-22827" }, { "cve": "CVE-2022-23181", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-23181" }, { "cve": "CVE-2022-23833", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-23833" }, { "cve": "CVE-2022-23852", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-23852" }, { "cve": "CVE-2022-23943", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-23943" }, { "cve": "CVE-2022-23990", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-23990" }, { "cve": "CVE-2022-24407", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-24407" }, { "cve": "CVE-2022-25235", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-25235" }, { "cve": "CVE-2022-25236", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-25236" }, { "cve": "CVE-2022-25313", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-25313" }, { "cve": "CVE-2022-25314", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-25314" }, { "cve": "CVE-2022-25315", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-25315" }, { "cve": "CVE-2022-26381", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-26381" }, { "cve": "CVE-2022-26383", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-26383" }, { "cve": "CVE-2022-26384", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-26384" }, { "cve": "CVE-2022-26386", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-26386" }, { "cve": "CVE-2022-26387", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-26387" }, { "cve": "CVE-2022-26485", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-26485" }, { "cve": "CVE-2022-26486", "notes": [ { "category": "description", "text": "In Xerox FreeFlow Print Server existieren mehrere Schwachstellen. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren." } ], "product_status": { "known_affected": [ "T000872", "T002977" ] }, "release_date": "2022-06-14T22:00:00Z", "title": "CVE-2022-26486" } ] }
ghsa-5qpf-4xwh-5775
Vulnerability from github
Published
2022-02-25 00:00
Modified
2022-03-26 00:01
Severity ?
Details
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
{ "affected": [], "aliases": [ "CVE-2021-44531" ], "database_specific": { "cwe_ids": [ "CWE-295" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2022-02-24T19:15:00Z", "severity": "HIGH" }, "details": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003c 12.22.9, \u003c 14.18.3, \u003c 16.13.2, and \u003c 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.", "id": "GHSA-5qpf-4xwh-5775", "modified": "2022-03-26T00:01:04Z", "published": "2022-02-25T00:00:58Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "type": "WEB", "url": "https://hackerone.com/reports/1429694" }, { "type": "WEB", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220325-0007" }, { "type": "WEB", "url": "https://www.debian.org/security/2022/dsa-5170" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "type": "CVSS_V3" } ] }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.